What an executable download scam is
An executable download scam is a scheme that gets you to open a program file, usually one ending in .exe, that does something different from what it promised. Instead of installing the free tool, cracked game client, or mod you were looking for, the file installs malware: a password stealer, a remote access tool, or a loader that fetches more malicious code once it's running on your machine.
The same trick works with other file types that need to be trusted to run, including Android APK files installed outside an official app store and Java .jar files. The delivery format changes, but the goal stays the same: get a file executed on your device before you've had a chance to check what it actually is.
How it works in practice
Most of these scams start with a search for something specific: a cracked version of paid software, a mod for a game, or a free utility that normally costs money. The search leads to a page that exists only to host that one download, often on a cheap domain extension such as .top, .icu, .cyou, .sbs, .click, .link, .shop, .space, or .rest, chosen because it's inexpensive and easy to abandon once the page gets flagged.
On the page, the actual file is frequently wrapped in a password-protected .zip or .rar archive, with the password printed right on the page. That password isn't there to protect you; it stops browsers and some antivirus tools from inspecting the file's contents before you open it, since a locked archive can't be scanned the way a plain file can. Once you extract and run it, you may be running a script dropper: a small program whose only job is to quietly fetch the real malicious payload from another location, so the file you first opened looks unremarkable even if someone examines it later.
Warning signs to look for
A handful of details repeat across these pages, and none of them require special tools to spot.
- The download is locked inside a password-protected .zip or .rar file, with the password given on the same page.
- The file extension doesn't match what you expected, such as an .exe or .jar file where a plain installer, document, or image should be.
- The page pushes urgency: countdown timers, "download now before it's removed," or a scan badge claiming the file is already verified safe.
- Running the file asks you to disable your antivirus, approve unusual permissions, or install a "required" second program.
- For Android files, you're asked to sideload an APK directly rather than install through an app store, skipping the checks that store would normally apply.
What to do if you're targeted
If you haven't run the file yet, don't. Close the page, and if you want a second opinion on the site itself before you download anything else from it, run it through the website checker, which looks at the same kind of signals described above.
If you've already run the file, disconnect the device from the internet, run a full scan with updated antivirus software, and change your important passwords from a different, clean device, since anything typed on the infected machine afterward should be treated as compromised. Some of these scams end with a demand to pay in cryptocurrency, often framed as a fee to "unlock" your files or verify you're not a bot. Don't send anything before checking the wallet address with the wallet checker; TrustSniffer has assessed 17,152 wallet addresses to date, and a quick check takes less time than the payment does.
How TrustSniffer checks for this
TrustSniffer has published analyses for 5,294 websites, and download pages built around this pattern show up regularly in that work. Each site we analyze gets a trust score from 0 to 100, where 100 reflects the most trust, not the least risk: it runs the opposite direction from a risk scale, so a high number is the reassuring one.
A score of 75-100 (High Trust) means the evidence collected is consistent with an established, legitimately operated site. A score of 50-74 (Moderate Trust) means most signals are reassuring but at least one area couldn't be verified or carried a caution. A score of 25-49 (Low Trust) means several signals typical of risky or unverified sites were present, and a score of 0-24 (Critical Risk) means the evidence matched patterns associated with scams or fraud. When a site blocks automated access or returns too little to judge, we mark it Needs Review instead of guessing.
You can run the same check on any download page before you click through: it takes less time than opening the file does, and it works whether or not you've spotted the warning signs above.
