Rockstar's extended look at Grand Theft Auto VI arrives on Netflix on August 27. There is still no demo, no beta and no PC build, but there is a network of convincing fake Rockstar sites offering one, and the file behind the Play Now button is a password stealer.
Malwarebytes researchers found the sites turning up in ordinary searches for a GTA 6 demo, one of them advertised in Google results as an Official Download and sitting alongside legitimate coverage. Follow the link and you get gta6_installer.exe, which is 1.1 MB. As the researchers point out, that is smaller than the screenshot they took of the page offering it, and nowhere near enough to hold a modern AAA game.
Why the leak created the opening
On August 18, genuine GTA 6 gameplay footage and what appears to be a complete map of the game's setting began circulating online, claimed by a person or group calling itself Cyberleek. Rockstar and Take-Two responded with takedowns, and Take-Two filed DMCA subpoenas seeking records from Microsoft and Discord that could identify whoever is behind the leaks. The malicious installer was first spotted the next day, on August 19. That timing is the whole trick. Once real unauthorized material is in circulation, people go looking for more of it, and no official channel exists to tell them which download is genuine.
What the 1.1 MB file takes
The sample belongs to the Vidar family, a well established stealer sold as a service to other criminals, and IntelFusions has covered Vidar campaigns hiding behind fake software cracks and fake job applications in recent months. This build went looking for saved passwords and login details, session cookies, browsing and download history, autofill and other saved browser profile data, and credentials stored by FTP clients. Malwarebytes counted 19 browser targets, including Chrome, Edge, Firefox, Brave, Opera and Vivaldi, and it also searched Thunderbird profile directories and targeted Perplexity's Comet browser and the WebView2 browser embedded inside Roblox Studio.
The behavior report showed no persistence at all: no startup entry, no scheduled task, no installed service. It produced no visible window and installed nothing a user would normally notice, so from the victim's side the supposed installer appears to do nothing. It does not need to stay. Once the passwords and tokens are gone, attackers can keep trying them long after the malware itself has been removed.
Changing your password may not close the door
Session cookies are the reason. When you sign in to a site, it hands your browser a token that says you have already authenticated, which is why you are not asked again on the next page. An attacker holding a stolen token may be able to resume that session without the password and without a second factor, because the session was created after the login had already succeeded. A password reset does not necessarily invalidate sessions that already exist.
If you ran it, revoke the sessions first
Scan and clean the affected machine, then change important passwords from a different, clean device, starting with the primary email account and then banking and payment services. The step people skip is the one that matters here: use each service's sign out everywhere or active sessions option to kill the stolen tokens. After that, check for the changes an attacker makes to keep access, including new email forwarding rules, added recovery addresses and phone numbers, unfamiliar authorized applications and unknown devices. Gaming accounts deserve the same treatment, since Steam and Epic accounts hold saved payment methods.
The reported sample has the SHA-256 hash a8f19d598e6a49d8510d73d41fc445246755ed321c2f76985a463a9fef537eb0. Malwarebytes says it detects the sample and blocks the sites and network infrastructure behind the campaign, and its write-up has the rest of the detail.
The pattern is older than this game. Any release with a fixed date and a huge audience attracts a fake early access page, and a leak makes it worse by removing the one signal a searcher would normally trust. GTA 6 is scheduled for November 19, 2026 on PlayStation 5 and Xbox Series X|S, with no PC version announced, so anything offering a playable build before then is lying about something.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.