Gaming and Personal Downloads on Work Devices: The Hidden Risk to Your Business
A staff member takes their work laptop home, installs a game launcher for the weekend, and downloads a “free” cheat or mod their friend recommended. On Monday the laptop seems fine. But if that download carried malware, the attacker may now hold the saved passwords and logged-in sessions for your email, accounting system and client portals.
Gaming itself is not the problem. The problem is that gaming and other personal downloads bring software from untrusted sources onto devices that hold your business data. This guide explains the risk and the practical controls that stop it.
Why gamers are a target
Gaming accounts, in-game items and gaming communities are worth money to criminals, so they target players with fake downloads. Security researchers have repeatedly documented information-stealing malware disguised as free game cheats, mods and pirated games, shared through forums, video descriptions, chat servers and code-sharing sites.
This type of malware, known as an infostealer, is built to collect:
- Passwords saved in web browsers
- Session cookies that keep people logged in, which can let an attacker skip the password and sometimes the MFA prompt
- Cryptocurrency wallets and gaming accounts
- Files from the desktop and documents folders
On a personal computer that is bad. On a work laptop, it hands an attacker the keys to your business.
How a personal download becomes a business breach
The Medibank breach is a clear Australian example of personal and work use crossing over. In its Federal Court case against Medibank, the OAIC alleges that an IT service desk worker at a Medibank contractor saved his Medibank login credentials to a personal web browser profile on his work computer. When he signed into that browser profile on his personal computer, the credentials synced across, and they were then stolen by malware. The attacker used them to access Medibank’s systems, and the personal information of around 9.7 million current and former customers was later compromised. The OAIC also alleges that Medibank’s VPN did not require multi-factor authentication.
The lesson for small businesses is simple: once work credentials can reach a personal device or personal account, your security is only as good as that device.
The common risky habits
- Installing games, launchers, cheats or mods on work devices.
- Downloading “free” or cracked software from unofficial sites to save buying a licence.
- Signing a personal browser profile into a work computer, so work passwords sync to home devices.
- Letting family members use a work laptop, including children who play games.
- Turning off antivirus because it slows a game down or flags a download.
- Running as an administrator, which lets anything be installed without a prompt.
Practical controls for your business
Remove local administrator rights
If staff cannot install software without IT approval, most risky downloads simply fail. Restricting administrative privileges is one of the ASD’s Essential Eight strategies. Our Essential Eight checklist for small business shows where to start.
Control which applications can run
Application control, another Essential Eight strategy, only allows approved software to run. Even if a staff member downloads a fake cheat, it will not execute.
Manage devices centrally
Device management tools such as Microsoft Intune let you enforce security settings, keep antivirus switched on, block personal browser profiles on work devices and wipe a lost laptop remotely.
Use strong multi-factor authentication
MFA stops many attacks that rely on stolen passwords. Phishing-resistant options and short session lifetimes make stolen cookies less useful. Read our guide to implementing MFA.
Keep work passwords out of personal browsers
Use a business password manager for work logins and do not allow work credentials to be saved in personal browser profiles or synced to personal accounts.
Write a clear acceptable use policy
Spell out what work devices can and cannot be used for, including games, personal software and use by family members. Most staff are happy to follow a rule once they understand the reason for it.
If something has already been installed
- Disconnect the device from the network.
- Reset passwords for every account used on that device, from a different, clean device.
- Sign the user out of all sessions in Microsoft 365 and other key systems.
- Have the device checked and, if in doubt, wiped and rebuilt.
- Report cybercrime to the ASD’s ACSC through ReportCyber at cyber.gov.au.
Key takeaways
- Work devices are for work. Games and personal downloads belong on personal devices.
- Infostealer malware hidden in cheats and pirated software targets saved passwords and logged-in sessions.
- Removing admin rights and using application control stop most of these downloads from running.
- Never let work credentials sync to personal browsers or devices.
Our managed IT security service puts these controls in place and monitors your devices around the clock, so one bad download does not become a business breach.
Do you know what is installed on your work devices?
Our free IT Health Check reviews admin rights, installed software and device security across your business so risky downloads cannot put your data at risk.
Or call 1300 133 770.
