Most cracks require you to disable your antivirus or add an exception for the "patcher." Once you do that, the crack can inject code that monitors your traffic, steals API keys, or scrapes login credentials—the exact opposite of what the software is meant to do.