Hackers Are Exploiting The 'GTA VI' Hype With Fake Demo Sites
The malware targets saved passwords, autofill data, and active session cookies across 19 different browser profiles.
Summary
Cybersecurity researchers uncovered a network of fraudulent websites mimicking official Rockstar Games branding to distribute infostealer malware
The malicious campaign tricks fans into downloading a non-existent PC demo that secretly harvests browser passwords and session cookies
Attackers are capitalizing on peak cultural hype surrounding an upcoming exclusive gameplay showcase and the November 2026 release date
Cybercriminals are actively exploiting the fever-pitch anticipation for Grand Theft Auto VI by weaponizing fake demo downloads against unsuspecting gamers. A sophisticated network of fraudulent websites has surfaced online featuring cloned promotional artwork designed to perfectly mimic official publisher channels. These malicious pages promise fans a playable PC build of the highly anticipated open-world crime title. Instead of delivering a sneak peek at the streets of Leonida, clicking the download button quietly installs a highly aggressive form of malware.
The threat takes the shape of a minuscule 1.1 megabyte executable file named “gta6_installer.exe” that houses a variant of the Vidar infostealer. According to researchers at Malwarebytes, the program operates by launching a victim’s own legitimate web browser in a hidden headless mode. This allows the software to bypass standard security walls and harvest sensitive information directly from local directories. The malware targets saved passwords, autofill data and active session cookies across 19 different browser profiles. Hijacking authenticated session tokens is particularly dangerous because it allows attackers to bypass multi-factor authentication protocols entirely and access social media, email and banking accounts.
Hackers deployed this scam to coincide perfectly with a massive official promotional beat. The fake websites deliberately leverage excitement for a scheduled “Extended Look” presentation set to premiere on Netflix this Thursday at 3 p.m. ET. This highly anticipated broadcast carries a six-hour exclusivity window on the streaming platform before hitting YouTube. By creating a false sense of urgency around the upcoming reveal, scammers are successfully baiting fans desperate for new gameplay footage. The infrastructure behind the cyberattack even uses dead-drop resolvers hidden within ordinary social media profiles on platforms like Telegram and Steam. This tactic allows the operators to quietly rotate their command servers and evade network bans.
Security experts strongly advise the gaming community to ignore any links offering early access or unofficial downloads. Rockstar Games has not announced a PC port for GTA 6 and a playable public demo simply does not exist. The legitimate title is officially slated to launch on November 19, 2026 for PlayStation 5 and Xbox Series X|S consoles. Players are urged to verify all promotional materials directly through official publisher channels to avoid compromising their digital security.
