A fake installer often looks like the real thing: same name, same logo, sometimes even the same version number. All it takes is a link received in a conversation or a poorly chosen search result to open it. This guide offers general checks, valid for any game, before you run a downloaded file.
Check the domain
Start with the site’s address, not its appearance. Cybermalveillance.gouv.fr, in its guide on phishing, advises reading the address shown in the browser: if it does not exactly match the site in question, it is very likely a fraudulent site, and sometimes only a single character differs. It also recommends hovering over a link, without clicking, to see its real destination, or using a bookmark you created yourself.
For Ankama games, the support team publishes a list of official websites (updated May 20, 2026), which includes www.dofus.com, account.ankama.com and support.ankama.com, among others. A domain name similar to these but missing from the list deserves suspicion. In its article on phishing, the support team asks players not to look up a site using keywords given by another player in-game and never to download files related to its games from an unofficial site. Remember the principle, which applies to a private server as much as to a publisher: the legitimate source is the one the project publishes itself on its own site.
Tell an announcement from a download mirror
An announcement on a forum, a video, a directory or a social network tells you a project exists; it is not the project. A mirror is a copy of a file hosted elsewhere, which you cannot trace back to its author. A few pointers:
- Always go from the announcement back to the project’s site, then look for the download link on that site, not in the comments.
- Be wary of a download page that differs from the one the project announces, of a shortened link, or of a file offered “faster” elsewhere.
- For updates, Cybermalveillance.gouv.fr, in its guide on managing updates, recommends downloading them only from publishers’ official sites or channels, being wary of fake update alerts that appear on websites or in pop-up windows, and reading pre-ticked boxes that could amount to accepting additional software.
For Togu, the Download page is the source for the launcher, available for macOS Apple silicon and Windows x64. Access to the closed alpha is free by invitation and requires a code from the Togu Discord. Download the file from this page only: a mirror does not establish its origin.
Check signature and checksum if the publisher provides them
Two complementary checks exist, provided the publisher publishes the reference information for them.
The signature. Apple explains, in its page Safely open apps on your Mac (published May 27, 2026), that macOS checks the Developer ID signature of software installed outside the App Store to make sure it comes from an identified developer and has not been modified. Since macOS Catalina, notarization is required by default: Apple has checked it for known malware. Before you first open downloaded software, macOS also asks for your approval. This check is a safety net; it does not replace verifying the source. Nor does it mean that signed software is free of flaws.
The checksum. A checksum (or hash) is a string of characters computed from a file’s contents. If the publisher publishes one on its official page, you can compute your file’s checksum and compare: if even a single letter differs, the file is not the one announced. On macOS, the command shasum -a 256 file-name in the Terminal app computes the SHA-256 checksum. Comparing two checksums only makes sense if the reference value comes from the official page; a checksum supplied by a third party proves nothing. [INFERENCE: when the page and the file come from the same hosting, the checksum detects corruption or a file substituted elsewhere, not a compromised page itself.]
Togu’s download page gives the SHA-256 checksum of each published launcher version. Compare it with the checksum of the downloaded file; this article does not copy those values, which change with every version.
Respond to an unexpected file
If macOS shows a warning, read it before acting. Apple distinguishes several cases: app downloaded from the Internet, unverified developer, software Apple cannot check, app that is damaged or contains malware. In that last case, the system states that the app cannot be opened and may move it to the Trash. For unverified cases, Apple recommends contacting the developer, looking for an updated version or an alternative in the App Store, and reminds you that running software that is neither signed nor notarized can expose your computer and your data. Do not disable your system’s protections to get around a warning you do not understand.
If you have opened a file you are unsure about:
- Protect your accounts: from another device, change the password of the services you were logged into, starting with your email.
- Run a scan: Ankama’s support recommends an antivirus, antispyware and antirootkit scan after a potentially corrupted download.
- Delete the file and do not pass it on to anyone.
- Report the site or message: Cybermalveillance.gouv.fr advises keeping the message you received and reporting a phishing site to Phishing Initiative.
To learn more about passwords and two-factor authentication, read our guide on securing a game account. The Togu community rules are on the rules page.
