The Difference Between Watching and Running: The Hidden Risk of Free Software and Games in P2P Shares

The promise of peer-to-peer (P2P) sharing is simple: an expensive game, a licensed application, even a pre-activated operating system, free and a few clicks away.

But there is a fundamental difference between downloading a TV episode and downloading a program. You think you’re watching a movie. In reality, you’re running a program. A video is opened by a media player and cannot do anything on its own. An installer, a game or a “crack” runs with your privileges the moment it is launched, and during installation it usually runs as administrator. Running a program from an unknown source means handing the keys to your computer to someone you have never met.

As of October 28, 2026, we recorded 8,408,577 peer observations across 35 categories in public P2P shares. This post focuses on the smallest but most dangerous part of that picture: the 70,391 peers in categories that contain executable files.

8.4M	70,391	0.84%	6
total peer observations	peers in executable categories	share of all observations	executable categories

Key Takeaways

The crowd is in video; the risk is in executables: most observations involve TV, anime, movies and adult content. Categories that contain executable files make up only 0.84% of the total, but every file downloaded there is meant to be run, not watched.
Games lead the executable group: 76% (53,565) of peers in executable categories are in PC games. The most popular game share is an 87 GB “repack”, the kind of package that ships with a large installer requesting administrator rights.
A cracked copy of free software: the most popular share in the software category is Visual Studio Code, which is already free. These users are downloading from an unknown source a program they could get from the official site at no cost, taking on risk with nothing to gain.
A “pre-activated” operating system: the operating-system category is topped by a Windows 11 image with security requirements (TPM) bypassed and activation pre-applied. An operating system built by an unknown party runs underneath everything on the machine.
macOS and Android are not exempt: a cracked Office for Mac build and a “Premium Cracked” Android app show the same risk on these platforms.
The end of the chain is stolen credentials: cracked software is among the best-known distribution channels for information-stealing malware (infostealers). Stolen passwords and session cookies are sold on dark web markets, and those taken from work devices become a doorway into corporate networks.

Why Executable Files?

Malware has to be run to do anything. That is why attackers favor files that users already intend to run:

	Media file (video, music, book)	Executable file (game, software, OS, app)
What does the user do?	Opens it and watches or reads	Installs and runs it
What processes the file?	A media player or reader	The computer itself
With what privileges?	The player’s limited privileges	The user’s privileges; usually administrator during installation
How easy is it to add malicious code?	Hard; usually needs a fake file or an extra lure	Easy; code added to the installer runs alongside the program
Does the user notice?	Gets suspicious if the video doesn’t play	Usually not, because the program keeps working

The last row is the critical one. A game installer with malicious code added still installs the game. The user plays it and has no reason to think anything is wrong, while another program keeps running in the background.

Executable Content in the Data

Across all categories, executable files look like a small slice:

Figure 1: Peers by main category (log scale). Orange bars mark categories that contain executable files.

But 70,391 peer observations is not a small number. Because the same IP address can appear in more than one observation, this figure is not a count of unique devices; each observation records an instance of a program from an unknown source being downloaded or shared.

Figure 2: Peers in executable categories and their share within the group.

Category	Peers	Share of total	Typical size	Top countries	Most popular share
PC games	53,565	0.64%	3.45 GB	US, China, Canada	Avatar: Frontiers of Pandora repack (87.1 GB)
Software (0day)	12,768	0.15%	125.7 MB	US, India, Canada	Visual Studio Code offline installer (108.5 MB)
Software / OS	3,324	0.04%	319.7 MB	US, Canada, UK	“TPM Bypassed & Pre-Activated” Windows 11 Pro (6.79 GB)
Disk images (ISO)	663	0.008%	2.17 GB	US, Turkey, Iceland	Arch Linux install image (1.49 GB)
macOS software	41	<0.001%	3.06 GB	US, Canada, France	Microsoft Office for Mac + Crack (3.06 GB)
Android APK	30	<0.001%	54.3 MB	UK, US, Hong Kong	SnapTube “Premium Cracked APK” (54.3 MB)
Total	70,391	0.84%

Note “0day” here does not mean a zero-day vulnerability. In file-sharing circles, “0day” is a category name for newly released software that is distributed quickly after release.

Risk by Category

PC games: the biggest crowd, the biggest installers

Three quarters of peers in executable categories are in games. A typical game share is 3.45 GB; the most popular one is 87 GB.

Most game shares are so-called “repacks”: compressed packages that ship with their own installer to unpack and write files to the system. For the user, this means running a package of tens of gigabytes, whose contents they cannot inspect, with administrator rights.

Three factors amplify the risk:

Name impersonation: the names of well-known repack groups are frequently imitated by fake shares and fake websites. Users see a name they trust and run the file without question.
“Disable your antivirus” instructions: a step commonly found in cracked-game installation notes, it hands the attacker’s hardest job to the user.
Cover provided by size: a small malicious file inside a very large package is hard to spot, both for users and for some security tools.

Software (0day): a “free” copy of free software

The most popular share in this category is Visual Studio Code, a code editor Microsoft already distributes for free. Users joining this share are downloading from an unknown source a program they could get from the official website safely and at no cost.

This shows that downloading software over P2P is not always about saving money. Sometimes it is habit, sometimes convenience. The outcome is the same: the user takes on all of the risk for none of the benefit.

This is the only executable category with India among its top downloading countries, and its most popular share is a developer tool. That matters: developer machines have access to source code, server access keys and cloud accounts, which makes them particularly valuable targets.

Operating systems: the layer beneath everything

This category is topped by a Windows 11 Pro installation image labeled “TPM Bypassed & Pre-Activated”. The label means two things:

“TPM Bypassed”: Windows 11’s hardware-based security requirements have been disabled.
“Pre-Activated”: licensing checks have been circumvented with an activation tool built into the image.

Installing it means running the most fundamental layer of the computer, the operating system, from a copy prepared by an unknown party. A modified operating system can see every program running on it, every password entered and all network traffic. Activation tools are also routinely flagged as malicious by security software, so users get used to ignoring those warnings, which makes a real threat harder to notice.

Disk images: legitimate content, a source that still needs verifying

The most popular share in this category is an Arch Linux installation image. Arch Linux is free and open source, and P2P is one of the official distribution methods for many Linux distributions. Not every P2P share is pirated content.

Even legitimate content should not be used without verification, though. Official distributions publish signatures and checksums so users can confirm a download has not been altered. A disk image installed without that check could be a modified copy. Turkey ranks second among downloading countries in this category, so the advice applies directly to Turkish users too.

MacOS and Android: the “it won’t happen to me” fallacy

Observation counts in these two categories are very small (41 and 30 peers), so we treat them as examples rather than statistical trends. The examples are clear, though:

macOS: the most popular share is a Microsoft Office for Mac build labeled “Crack”. Cracked Mac applications are a known distribution route for information stealers targeting macOS, and the belief that “Macs don’t get viruses” makes the risk worse.
Android: the most popular share is a YouTube downloader labeled “Premium Cracked”. Modified apps installed outside the official store can request access to messages, contacts and notifications, which creates risks such as stolen two-factor authentication codes.

The Real Price of Free Software: The Infostealer Chain

What happens when a cracked program or game installer is run is one of the best-known malware chains in threat intelligence:

Installation: the user installs the free program. Often it really works, so the user notices nothing wrong.
Collection: an infostealer running in the background collects saved browser passwords, session cookies, crypto wallets and stored credentials within seconds.
Exfiltration: the collected data is sent to the attacker in packages known as “logs”.
Sale: the logs are sold on dark web markets and Telegram channels.
Use: the buyer can use stolen session cookies to log into accounts without a password or two-factor authentication.

If the device is a work computer, the last link in the chain is far more serious. Credentials for corporate email, VPN, cloud and SaaS accounts are among the most common initial access routes ransomware groups use to enter corporate networks. The real price of a free program is often paid by the user’s employer.

ThreatMon Analyst Assessment

Finding	Status	ThreatMon Assessment
70,391 peers in executable categories	Measured	0.84% of the total. A small share, but each observation is an instance of a program from an unknown source being downloaded or shared. The same IP can appear more than once, so this is not a unique-device count.
Games make up 76% of the group	Measured	Large, hard-to-inspect installers run with administrator rights. The highest-volume risk in the group.
Free software is also downloaded over P2P	Measured	A free program tops the software category. Users take on risk with nothing to gain.
Modified OS images are in circulation	Measured	Pre-activated Windows images with security checks disabled make the machine’s most fundamental layer untrustworthy.
Cracked apps on macOS and Android	Measured (very small sample)	41 and 30 peers. To be read as examples, not trends.
Cracked software carries infostealers	Widely observed in industry	No file scanning was performed on this dataset. A continuously observed and well-documented infostealer distribution channel.
Stolen data turns into corporate access	Assessment	A single cracked program installed on a work computer can hand attackers the credentials to corporate accounts.

How to Protect Yourself and Your Organization

For individual users

Download software only from official sources. Getting even a free program over P2P means taking a risk for no benefit.
Don’t run cracked software, games, “cracks”, “keygens” or “activators”, especially if the installation notes tell you to disable your antivirus.
Don’t install modified operating system images. Get your OS only through the vendor’s official channels.
Verify legitimate files too. For content officially distributed over P2P, such as Linux distributions, check the published signature and checksum.
Don’t install apps on your phone from outside the official store. APKs labeled “Premium”, “Mod” or “Cracked” are especially risky.
If in doubt, change your passwords and sign out of all sessions on all devices. Infostealers take session cookies along with passwords.

For organizations

Use application allowlisting. Unapproved installers, activation tools and P2P clients should not be able to run on managed devices.
Don’t give users administrator rights. Without them, most cracked installers cannot be installed.
Monitor with EDR. Processes launched from user folders that access browser data files shortly afterwards are a typical sign of infostealer activity.
Pay special attention to developer machines. Devices with access to source code, access keys and cloud accounts need a strict software-source policy.
Block P2P traffic on the corporate network, or alert on it using application-aware firewall policies.
Track employees’ corporate credentials. Regularly check whether they appear in infostealer logs or on dark web markets. When a match is found, revoke sessions and reset passwords.

How ThreatMon Helps

A user who installs a cracked game or program usually notices nothing wrong. The game launches, the program works. Meanwhile, the passwords and session cookies collected in the background may already be in an attacker’s hands, or up for sale on a Telegram channel. The organization usually finds out through a suspicious login, a data leak or a ransomware incident, when it is already too late.

ThreatMon works to make this silent damage visible before attackers can use it:

Monitors infostealer logs: tracks when credentials and session cookies for your employees’ corporate accounts appear in infostealer logs, on dark web markets and in Telegram channels, and alerts the organization immediately.
Tracks malicious campaigns: follows malware campaigns disguised as cracked software, game repacks, activation tools and fake apps, and makes their indicators of compromise (IoCs) available to security teams.
Detects P2P exposure: flags when your organization’s IP ranges appear in public P2P activity, so devices downloading cracked software from the corporate network can be found before a malicious file runs or stolen data is used.
Connects the signals: correlates P2P exposure, stolen credentials and threat-actor chatter to surface a compromised device or an account up for sale in a single alert.

Users, and the organizations they work for, pay the price of free software. ThreatMon’s goal is to make sure that price is spotted before it turns into a security incident.

Limitations

No file scanning was performed on this dataset. We did not measure how many shared files are malicious. Information on malicious techniques and the infostealer chain is based on widely observed industry patterns.
Categories come from the shares’ own labels, which are not always accurate. For example, the most popular share in the “Books” category appears to be a TV episode. Read category counts as approximate.
The macOS and Android categories are very small (41 and 30 peers) and are treated as examples, not trends.
Observations are not people. The same IP is counted once per share it appears in, and VPNs and CGNAT put many users behind a single address.
This is a single snapshot. The most popular shares change from day to day.

Ethics and Privacy

No IP addresses, IP ranges or personally identifying information are published in this post. All results are aggregated statistics. IP addresses are personal data under regulations such as the GDPR and Turkey’s KVKK, and the raw dataset will not be released.

Conclusion

Most of the 8.4 million peer observations involve content downloaded to be watched.The real risk sits in a small group downloaded to be run: 70,391 peer observations involving games, programs, operating systems and apps from unknown sources that end up installed on devices. Some of those programs are already free. Some of those operating systems have had their security checks deliberately switched off.

At worst, a video file won’t open. A cracked installer can appear to work perfectly while handing passwords, sessions and corporate access to attackers. By the time the price of free software is noticed, it has usually already been paid.