Virus Hunt

Web browser
Crash screen
First screen
Email
Customizable
Pop up mania

Inspiration

Almost everyone knows someone who's been scammed: a parent who let "tech support" onto their computer, or a friend who bought gift cards for someone "stranded abroad". Online-safety advice usually comes as a list of rules you read before anything happens, and it rarely sticks. People learn best from experience, but real experience costs real money. We wanted somewhere you could fall for a scam and lose nothing.

What it does

Virus Hunt puts you in front of VirusHuntOS, a fake 2004-era PC that runs right in your browser. It works like a real computer: you can drag windows around, browse the web, check your email, use your bank and chat with friends. Eight viruses and scams are hidden in it:

PhotoWorm: Mum's hacked social media post links to a "photo viewer" that floods your screen with pop-ups that copy themselves
The Empty Account: an email ad for a $5 gift card that's really after your bank login
The USB Stick: a holiday photo on a flash drive that turns out to be holiday_03.jpg.exe
The Hot Stock Tip: a sponsored news post that pushes a shady trading app
Four live scammer chats: fake tech support, a "friend" in trouble, a romance scam and a fake bank security team, each one played live by Gemini AI

The game has one rule: it never warns you at the moment of the mistake. There are no red banners and no "are you sure?" boxes. You fall for it, see what happens, track the virus down and clean it up. Then a lesson card unlocks that points out every red flag you could have spotted. A VIRUSES CAUGHT x/8 counter tracks your progress, and Scout, a pixel-art detective, walks new players through their first infection.

How we built it

React 19 + TypeScript on TanStack Start, built and hosted with Lovable, with NES.css for the retro pixel look
A small "operating system" layer: a window manager written as a pure, tested reducer, a virtual file system with C: and E: drives, shared stores saved in localStorage, and a system event bus
Each storyline listens to that event bus (site visits, opened files, chat messages and so on), so the four of us could each build our own storyline in our own folder without breaking each other's work
The scammer chats use Gemini through a server function. API keys never reach the browser, and a test fails if they ever show up in client code.
Only fictional brands, and nothing is ever loaded from the real internet

Challenges we ran into

Gemini 402 errors. Partway through, the Gemini API started rejecting our requests with 402 Payment Required, and the live scammer chats stopped working. Our scripted fallback took over, so the game kept running, but it was a stressful moment.
Keeping the API key server-side. Handling the .env file tripped us up, and at one point the chat was running on scripted lines without any of us noticing.
GitHub workflow. Four people pushing to one repo was messy at first: merge conflicts, and edits to the same shared files. It took a few tries before we found a branch-and-pull-request rhythm that worked.
Balancing the viruses. Every scam had to feel realistic, be findable without a guide, and still have enough depth to teach something. If it's too obvious, nobody falls for it. If it's too subtle, nobody finds it.

What we learned

Always have a plan B for external APIs. Building the scripted fallback early is what saved us when Gemini started returning 402s.
Make your fallbacks visible. A fallback that kicks in silently can hide a broken setup, so the chat now tells you when it has switched to scripted replies.
Agree on a git workflow on day one. One branch per person, one owner for the shared core, and small pull requests let four of us build in parallel.
Realism comes from real red flags. Basing each scam on how it happens in real life made it believable. The VIRUSES CAUGHT counter made it findable. Saving the lesson until after the mistake made it stick.