Czech anti-virus firm Avast says it detected virus activity at more than 60 sites with the words "game" or "arcade" in their title in the 30 days ending last Thursday.
The gaming sites are being targeted because young children are often less ware than adults of what they click on when visiting such sites, company officials said.
"These are sites with mini-games, including flash applications and simple online apps -- one example is software that allows girls to dress and change the clothes of characters," Ondrej Vlcek, the firm's chief technical officer, told the BBC.
Avast said "exploit packs" that are sold online meant the hackers responsible might not have needed advanced coding skills.
"This report highlights the need for children and young people to be made aware of the potential security risks associated with free online gaming sites," said Joanne Bryce of the cyberspace research unit at the University of Central Lancashire.
Millions of Getty images now available for free via embed tool
Boston schools pull out free condoms over wrapping complaints