Cybersecurity Foundations (Grades 6–8) · lesson 31 of 48 · 8 min
Every Download Is a Decision — Make It an Informed One
Every file you download from the internet is a potential risk. Malware is most commonly delivered through downloads — disguised as useful programs, game cheats, cracked software, free movies, or even fake security tools. The moment you open a malicious file, an attacker can gain full control of your device.
The good news: most malicious downloads have detectable warning signs. This lesson gives you a reliable checklist for evaluating any download before you open it, and teaches you how to verify files using hash checking and VirusTotal.
By the end of this lesson you will be able to identify red flags in file downloads, verify files using hash checking, use VirusTotal to scan suspicious files, and evaluate browser extensions safely.
The piracy trap
Pirated software is one of the most common malware delivery methods. Studies show that over 30% of pirated software contains malware. The “crack” or “keygen” that bypasses software licensing is almost always malware — often a Remote Access Trojan (RAT) that gives the attacker full control of your computer. The “free” software costs far more than the legitimate version when you factor in the damage.
Why Downloads Are Risky
Every file you download from the internet is a potential risk. Malware — malicious software — is most commonly delivered through downloads. Attackers disguise malware as useful programs, game cheats, cracked software, free movies, or even fake security tools.
The goal of this lesson is to give you a reliable checklist for evaluating any download before you open it.
Scale of the problem
According to security researchers, over 450,000 new malicious programs are detected every day. The majority arrive via downloads and email attachments. A single bad download can give an attacker full control of your device.
Red Flags in File Downloads
Safe Download Checklist
Before downloading any file, run through this checklist:
Browser Extensions — Extra Caution Required
Browser extensions deserve special attention because they have unusually broad access. A typical extension can read and modify every page you visit, see your browsing history, intercept form submissions, and access your clipboard. This is more access than most desktop apps get.
Permission warning signs
Be suspicious of any extension that requests: “Read and change all your data on all websites”, “Access your clipboard”, or “Manage your downloads”. A simple ad blocker needs broad site access — but a grammar checker or colour picker does not need to read every page you visit.
Sorting Activity — Safe or Risky?
- Downloading Firefox from mozilla.org
- safe
The official developer website is always the safest source for software.
- Opening a file named “report.docx.exe”
- risky
The real extension is .exe — an executable. The .docx is a decoy to make you think it is a Word document.
- Uploading a suspicious file to VirusTotal before opening
- safe
VirusTotal scans files against 70+ antivirus engines and is free to use.
- Installing a cracked version of paid software
- risky
Cracked software almost always contains malware. The “free” version costs you your security.
- Choosing “Custom install” to uncheck bundled adware
- safe
Many installers bundle unwanted software. Custom install lets you opt out.
- Installing a browser extension from a forum post link
- risky
Extensions from unofficial sources bypass the browser store’s security review process.
Knowledge Check
Safe Downloads and Extensions
A file is named “invoice.pdf.exe”. What is the actual file type?
- PDF document
- Executable program
- Compressed archive
- Image file
Answer: Executable program
The real extension is the last one — .exe. The .pdf is a decoy. This is a classic malware delivery technique called a double extension.
What does VirusTotal do?
- Removes viruses from your computer
- Scans a file against 70+ antivirus engines before you open it
- Blocks malicious websites in real time
- Encrypts your downloads
Answer: Scans a file against 70+ antivirus engines before you open it
VirusTotal is a free online service that checks files and URLs against dozens of security engines simultaneously.
Browser extensions can read and modify every page you visit if they have the right permissions.
- True
- False
Answer: True
Extensions with broad site permissions can read form data, passwords, and page content on every site you visit — which is why extension source matters.
Where is the safest place to download software?
- The first Google result for the software name
- The developer’s official website or trusted platform store
- A forum post with a direct download link
- Any site with HTTPS
Answer: The developer’s official website or trusted platform store
Official sources are controlled by the developer. Search results and forum links can lead to malicious lookalike sites.
Comparing a downloaded file’s hash to the one listed on the official site confirms the file was not _____.
Answer: tampered with
Hash verification (MD5 or SHA-256) proves the file is identical to what the developer published. Any modification changes the hash.
Real-World Case Studies
Case 1: The CCleaner Supply Chain Attack (2017)
CCleaner is a legitimate, popular PC cleaning tool with millions of users. In 2017, attackers compromised Piriform’s (CCleaner’s developer) build server and inserted malware into the official CCleaner installer. Over 2.27 million users downloaded the infected version from the official website. The malware was designed to target technology companies specifically. This case shows that even official downloads from trusted sources can be compromised — hash verification would have detected the tampered file.
Case 2: Fake VPN Apps on App Stores
In 2023, researchers found dozens of fake VPN apps on the Google Play Store and Apple App Store that claimed to protect privacy but actually harvested user data, injected ads, or installed additional malware. Some had millions of downloads and high ratings (boosted by fake reviews). The lesson: even official app stores are not perfectly safe. Check developer reputation, read recent reviews critically, and verify the app is from the real developer’s official account.
Previous lesson: Cookies and tracking
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Recognizing misinformation