Counter-Strike creator ohnePixel got caught out by an old-school internet prank on stream.
During a recent broadcast, he loaded up an unfamiliar website. Instead of a normal page, a small browser window popped up showing explicit male nudity, complete with loud, high-pitched audio and a sped-up parody song blasting over the stream.
Then the window started moving. It bounced around his desktop like a DVD screensaver, dragging the close button with it while he tried to click it. His cursor chased the pop-up across the screen for several seconds, not exactly the aim you’d expect from someone in the CS ecosystem.
He didn’t reach for Alt+F4, Ctrl+W, the taskbar, or Task Manager. He just kept clicking.
Once he finally got control of his screen back, he noticed something else had happened: the site had put a file on his computer. So he opened it. In the Windows image viewer. On stream.
The file appeared to display normally, and he then asked out loud whether it could do any damage or if it could result in his computer being hacked.
There’s no evidence that it did. No malware alerts, no account breaches, no lost control of his setup have been documented. The moving window was almost certainly just a browser trick, likely a single pop-up being repositioned over and over with JavaScript, rather than anything running on his system.
As for the file: a normal PNG is data, not a program, and it doesn’t run code just by existing. Renaming an .exe to .png doesn’t make Windows Photos launch it either. But “unlikely” isn’t “impossible,” specially crafted images can target bugs in image decoders, and double extensions like photo.png.exe still fool people when Windows hides file types. Opening an unrequested download from a site that just ambushed you with explicit content is still the worst option on the menu.
For streamers, the risk goes beyond viruses. Explicit content on screen can breach platform rules even when it’s accidental, and a panicked scramble to close a window can expose tabs, downloads, and personal info to thousands of viewers.
The safer route is boring: a separate machine or VM for unknown links, a browser profile with no saved passwords, pop-ups blocked, and mods checking links first.
