Is cracked software safe? Cracks, cheats and stealers

Is cracked software safe? It is the question behind every "free Photoshop", "cracked Office", keygen, "undetected aimbot" and "free FIFA coins" search. The honest answer is that a crack is the single most reliable way to hand a stranger your passwords. You are running a program from someone you do not know, who asked you to switch your protection off first.

This guide shows how the trap works, why the crack "does nothing" when you open it, and what to download instead.

Why cracks and cheats are still the favourite trap

Thieves love cracks for a simple reason: you run the file yourself. No hacking is needed. You downloaded it on purpose, you ignored the warning on purpose, and you often gave it administrator rights on purpose.

The money that comes out the other end is real. Americans reported these losses to the FBI for 2025:

$1.31Blost to personal data breaches: data copied or stolen by someone else67,456 complaints

$20.9Blost to all online crime reported to the FBI26% more than in 2024

Source: FBI IC3, Apr 2026

That first figure covers every way personal data gets stolen, not only cracks. But a stealer from a crack goes straight for the same things, and for crypto: in 2025, thieves took $713 million straight from people's own crypto wallets, according to Chainalysis.

The scale of the crack trade is large too. In June 2026, Malwarebytes reported that one campaign hiding stealers inside pirated PC games had infected more than 400,000 devices worldwide.

If you want the bigger picture of what a stealer is and every way one gets in, read what an infostealer is.

Where fake cracks and cheats hide

You rarely find these files on a shady-looking site. They are spread through places you already trust:

• YouTube videos. A tutorial-style video shows the "free" app or cheat working, with the download link in the description. Check Point Research helped take down a whole network of these videos, posted from stolen and fake channels that also filled the comments with fake praise.
• Discord servers and gaming forums. "Undetected" cheats and executors are shared in communities and by accounts that were stolen from real players.
• Real code and file sites. GitHub, SourceForge, MediaFire, Google Drive and similar services host the files, which makes the link look respectable.
• Piracy and repack sites. Full "cracked" games come with a poisoned launcher bundled in.

For power usersWhy password-protected archives dodge scanners

A zip or rar file locked with a password is encrypted. Your browser, your email provider and the file host cannot look inside it, so their malware scans see nothing wrong. The password is posted next to the link, in a pinned comment or a community post, where only a human will read it. Once you extract it yourself, the file is already on your disk, and the readme asks you to disable real-time protection before you run it. A legitimate free program has no reason to do any of this.

How a free cheat empties your accounts

Here is the most common version of the trap, step by step, as you would see it. The names, channel and links are made up.

1. 1A video promises a free, undetected cheatIt looks like any other tutorial, with thousands of views.
   videos.example/watch?v=aim7

   Aimbot + wallhack 2026 free8:41

   AIMBOT + WALLHACK 2026 | UNDETECTED | FREE

   NNovaCheats HQ48K followersFollow

   Works on every server, no ban. Download below.

   hxxps://filedrop-share.cc/aim-v71

   Archive password: 20262

   1. 1Not the game's site or any store: a random file host
   2. 2A free download with a password is hiding its contents from scanners
2. 2The comments say it worksStolen and fake accounts post these in bulk to make the video look safe.
   videos.example/watch?v=aim7

   1,204 comments

   XxNova_772 days agoworks perfectly, thanks broReply

   LLukasPlays3 days agono virus, defender just flags every cheat1Reply

   Kkira.gg1 week agostill undetected in OctoberReply
   1. 1The setup for the next step: you are told to ignore the warning
3. 3The readme asks you to switch your protection offNo real program needs this. This is the moment to stop.WindowsmacOS
   README.txt

   FileEditView

   1HOW TO INSTALL

   2

   31. Turn off Windows Defender real-time protection (it deletes the cheat, false positive)1

   42. Extract the archive with password 2026

   53. Run setup.exe as administrator

   1. 1This only exists so the stealer can run without being stopped
   NovaLoader

   NNovaLoader

   Cracked apps can't be notarized.

   Right-click NovaLoader, choose Open, then Open again1

   1. 1This tells you to override the Mac's own check for unknown apps
4. 4You run it, and nothing seems to happenThe real work is happening behind the screen.WindowsmacOS
   NovaLoader v7

   NFree edition

   Preparing your cheat

   Injecting... done

   Loading game files...197%

   1. 1It freezes here at the end. The stealer is already running in the background
   NovaLoader1

   NovaLoader wants to finish installing.

   Enter your password to allow this.

   Password2

   OKCancel

   1. 1Not a macOS window: the downloaded app drew it to get your password
   2. 2With your password it can open even more of what you have saved
5. dangerBehind the scenes, it empties your accountsYou close the window, try again later and blame the cheat for being broken.

   What the crack takes from you

   • Every saved passwordEmail, bank, exchange, socials
   • Your logged-in sessionsAccounts open without a password or 2FA code
   • Your crypto walletsGone for good: a blockchain transfer cannot be undone
   • Your Steam and Discord accountsSkins sold, friends sent the same cheat

   All of it in seconds, while you wait for a cheat that never loads.

With antitheft

With antitheft, the stealer is stopped at your passwords

• Caught the moment it reaches for your passwords or wallets
• On Linux refused before the file opens, on Windows and macOS stopped right after
• Even the most advanced malware, the kind no antivirus has seen yet

antitheftCRITICALjust now

setup.exe tried to read Steam's saved login - blocked

?

setup.exe

C:\Users\you\Downloads\aim-v7\setup.exe

Touched

Steam - Saved login

Type

Storage access

KILLNOT A THREATVIEW DETAILS

antitheftCRITICALjust now

NovaLoader tried to read Google Chrome's saved passwords - blocked

?

NovaLoader

/Volumes/NovaLoader/NovaLoader.app/Contents/MacOS/NovaLoader

Touched

Google Chrome - Saved passwords

Type

Storage access

KILLNOT A THREATVIEW DETAILS

Keep stealers out of your passwords and wallets

• Guards passwords, browser logins and wallets
• Stops malware your antivirus misses
• On Windows, macOS and Linux

See what antitheft protects

Why the crack "does nothing" when you run it

This is the part that fools almost everyone. You double-click, a window appears for a second, maybe a loading bar, and then nothing. Or an error. Or the game starts and seems to work.

In each case, the stealer has already run. Researchers have documented all three versions:

• A loading screen that freezes at the end. Kaspersky's researchers found cracked games whose launcher stopped at full progress while the stealer ran behind it.
• A game or installer that works normally. Malwarebytes found pirated games that run as expected while the malware installs silently in the background.
• A fake "scan" that says the file is clean. Kaspersky found download pages showing a banner claiming the file was checked by several antivirus engines. No scan actually happens.

A stealer does not need to stay on your computer. Copying a browser profile, a wallet file and a Steam login takes seconds. Many delete themselves afterwards, so there is nothing left to find.

For power usersWhat the Mac version looks like

Cracked Mac apps arrive as a disk image whose background picture tells you how to get past Gatekeeper: right-click, Open, Open again, or drag a file into Terminal. Huntress notes these installers often explain that "cracked apps can't be notarized" to make the override feel normal. Then a window that looks like it belongs to macOS asks for your password. Mac stealers use that password to unlock more of what you have saved, including your Keychain, before they copy browsers, wallets and Telegram.

Red flags in any download

If you see even one of these, close the page:

• A paid app, game or cheat offered for free
• A password for the archive posted next to the link
• Instructions to turn off your antivirus, Windows Defender or SmartScreen
• On a Mac, instructions to right-click and Open, or to paste something into Terminal
• A link to a random file host instead of the developer's site or a store
• A comment section full of "works, no virus" replies
• A request to run it "as administrator" or type your Mac password to "finish installing"

What to download instead

You do not have to choose between paying full price and getting robbed. These options cost little or nothing:

1. Use the official free version or trial. Most big apps have a free tier, a trial or a cheaper plan for students.
2. Pick a free, open alternative. GIMP or Krita instead of Photoshop, LibreOffice instead of Office, Audacity for audio, DaVinci Resolve's free edition for video.
3. Wait for a sale. Games on the big stores drop in price constantly, and many have free weekends.
4. Play without cheats. Anything that promises to be "undetected" also has to hide from your own computer's defences. That is how stealers are built too.
5. Download only from the developer's site or your system's app store. Type the address yourself instead of clicking a link in a video description.

What to do if you already ran a crack

Do this from a different device you trust, such as your phone, not the computer that ran the crack:

1. Disconnect the computer from the internet.
2. Move your crypto first. Create a new wallet with a new seed phrase on a clean device and send your funds there. A blockchain transfer cannot be reversed, so every hour counts.
3. Change your most important passwords: email first, then banking, exchanges, Steam, Discord and your password manager.
4. Log out of every session. Use "sign out of all devices" in each account's security settings. This kills the stolen session cookies.
5. Turn on two-factor authentication with an authenticator app wherever it was off.
6. Check your email on Have I Been Pwned to see where it already turned up.
7. Reinstall the computer before you log back into anything on it. A cleaned system cannot be proven clean.

For power usersExtra steps for gamers and developers

On Steam, deauthorize all other devices and check for trade offers or market listings you did not make. On Discord, check Authorized Apps and change your password, which resets your token. If you write code, rotate SSH keys, API tokens and cloud credentials, and check your Git hosting for new keys or OAuth apps.

Why a scan alone does not catch cracks

A crack is built to get past your defences. It hides in an encrypted archive, it asks you to switch protection off, and it is rebuilt so often that a fresh copy has never been seen before.

So protect the places thieves go instead. Your Steam login should only be opened by Steam. Your browser's passwords should only be opened by your browser. Your wallet should only be opened by your wallet.

That is what antitheft does. It lets only the app that owns your passwords, browser logins, session cookies, wallets and game accounts open them. Anything else is refused, so even a brand new stealer hiding in a crack walks away with nothing.

Questions people ask

Is cracked software safe if my antivirus says the file is clean?

No. Cracks often come in password-protected archives so that scanners cannot look inside, and stealers are rebuilt so often that a fresh copy can pass a scan. A clean scan of a crack tells you very little.

My antivirus flagged the crack. Isn't that just a false positive?

Treat it as real. "It's a false positive, turn off your antivirus" is the exact line the people spreading stealers use, because the warning is the one thing standing between them and your passwords.

Are game cheats from Discord or YouTube safe if lots of people say they work?

No. Researchers have found networks of stolen and fake accounts that post the videos, the download links and the happy comments. A video full of likes and "works, no virus" replies is part of the trap, not proof that the file is safe.

Can a Mac get a stealer from a cracked app?

Yes. Cracked Mac apps are a known way stealers spread. The download usually tells you to override the Mac's own check for unknown apps and then asks for your password in a fake system window. Your password lets it open even more of what you have saved.

I ran a crack and it did nothing. Am I fine?

Assume you are not. A crack that seems to do nothing, freezes at the end of loading or shows an error has very often already done its job in the background. Follow the steps in the "already ran one" section from a different, clean device.

the short version

No. Cracked software and game cheats are the oldest way password stealers spread, and they still work every day. The "crack" you run is the thief: it copies your saved passwords, logged-in sessions, crypto wallets and game accounts in seconds, and often looks like it did nothing at all. Get the real app, a free alternative or an official trial instead.

sources

1. FBI Internet Crime Complaint Center: 2025 IC3 Annual Report (Apr 2026)
2. Chainalysis: 2025 crypto theft reaches $3.4 billion (personal wallet compromises) (Dec 2025)
3. Check Point Research: The YouTube Ghost Network, 3,000 malicious videos taken down (Oct 2025)
4. Malwarebytes: Pirated PC games are delivering password-stealing malware (Jun 2026)
5. Kaspersky Securelist: The RenEngine campaign, when "free" comes at too high a price (Feb 2026)
6. Malwarebytes: Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding (Jul 2026)
7. Kaspersky: The Stealka stealer masquerades as pirated software (Dec 2025)
8. Malwarebytes: From fake Proton VPN sites to gaming mods, this Windows infostealer is everywhere (Apr 2026)
9. Bitdefender Labs: Fake Xeno Roblox cheats deliver a Java stealer through Discord and forums (Aug 2026)
10. Huntress: Deceptive installers, how fake apps target macOS (Jun 2026)
11. Kaspersky Securelist: A new version of the MacSync macOS stealer (Sep 2026)
12. Have I Been Pwned: check if your email appeared in a breach