The GTA VI scam cycle has picked up again as we close in on November 19, and the newest disguise borrows the leak instead of the trailer. On September 1, security researchers and outlets tracked a scam page at latestgta6[.]com that claimed to be selling a copy of the unreleased game "stolen" by CyberLeek, the group behind the leaked test-build footage. The bait price was around $50. Antivirus provider Malwarebytes flagged the site as one designed to drain cryptocurrency wallets. It is an escalation of the pattern Next Vice has tracked all summer: every leak wave now spawns paid "leaked copy" and crypto-checkout pages almost immediately, and the scammers are scaling that up as launch approaches.
The September leak-copy con sits on top of the scam machine that already sprouted a fresh face around the August 27 Netflix premiere of An Extended Look. Malwarebytes detailed that one on August 24: a network of fake Rockstar demo sites copies Rockstar's genuine Extended Look promo, shows up in "GTA 6 demo" searches, and advertises an "Official Download." Visitors who hit the "Play Now" button can end up downloading gta6_installer.exe. That file is not a demo, a game, or a video. It is an information stealer built to lift passwords stored in browsers, cookies, and authenticated sessions. Because stolen browser sessions can sometimes be reused without a fresh login, even two-factor authentication may not be enough to stop it. A strong tell: the deliverable is just over one megabyte, nowhere near big enough to hold a modern AAA game.
That Extended Look trap sits on top of the week's other leak-rider scams. A fake 113GB GTA 6 "build" is now being shared across torrent sites, and a user who picked the files apart reports the package is fake and carries malware that can steal personal data or damage a machine. Notebookcheck covered the find on August 23. The paid early-access line never went away either, and the fake "Build Vice City" beta is still documented by The Guardian and NordVPN. That con builds a convincing site, sometimes reusing real Rockstar artwork of Jason and Lucia, and asks for your Rockstar Social Club, PSN, Xbox, or Steam login on a page that copies the real one. It then pushes a download, an EXE on PC or an APK on Android, dressed up as a testing client. Researchers found those files stealing credentials, hijacking GPUs to mine crypto, and on Android intercepting SMS messages so two-factor codes can be swiped first. The domain is usually a slight misspelling of Rockstar's real address, a classic typosquatting tell.
On September 9, the security firm Huntress published something worse, and it is the most detailed look yet at what one of these fake builds actually does to a machine. The sample came from a sandbox and arrived as an ISO file, the kind of disc image a real modern release would realistically ship in, which is exactly why the disguise works. Mount it and you get a file called gta6installer.exe wearing a Grand Theft Auto V icon, an odd detail that should stop anyone cold. Run it and an installer appears with a message in Russian explaining that the product is an unlicensed leaked copy, that the game may not start, and that a "License not found" error means the crack has been fixed. There is even an email address to write to for a working crack. The error is not a bug. It is scripted, shown on purpose to make a failed install feel plausible while the real payload installs behind it.
What Huntress found inside that ISO is the part worth reading twice. The package carries a fake installer, several remote access trojans, an infostealer, ransomware being used as a wiper, and a web browser. Files land in the TEMP folder with reassuring names like rockstar.exe, steam.exe, rockstargames.exe, and rockstargamescrashfixer.exe. Three copies of NJRAT, a well known remote access trojan, open a shell on the machine, log keystrokes, reach the camera, pull saved browser passwords, and grab cryptocurrency details. A second trojan, DCRAT, installs under a hidden name and edits the Windows hosts file to cut off antivirus reporting and telemetry, which is how a machine goes quiet after it is owned. A third tool, the Mercurial Grabber infostealer, sweeps up Discord tokens, Chrome passwords and cookies, Roblox Studio cookies, Minecraft session data, and Windows product keys, then ships them out over a Discord webhook. Huntress notes the files inside date back to 2023 in many cases, old malware repurposed for a new audience. It also notes the campaign appears aimed at Russian gamers, based on the language in the installer and the eventual ransom note.
Huntress flagged the scale trick behind it too. Some of these ISOs top 100GB, but the size is fake: the file is padded with junk data to look like a real AAA install, while the actual malicious payload is a fraction of that. The distribution is not subtle either. Huntress says it has seen SEO poisoning built to rank high in searches for a leaked copy, plus ISOs posted on gaming forums, social media, and torrent sites. Old advice about "checking the file size" only half works here. A hundred gigabyte download is not proof of anything, because the padding is the point.
All of these share the same boundary, and Huntress states it plainly: there is no official GTA VI demo, and no real leaked, playable copy of the game is being distributed. The leaked footage and map image that set this off are real leaks, but they are not a playable build, and the group behind them has not released anything you can actually run. So any "playable build," "demo," "leaked copy," or "PC download" that shows up online is not what it claims to be. Rockstar has not announced a GTA VI demo, a PC version, a beta, a technical preview, or an early-access offering. An Extended Look is a video premiering on Netflix and later on Rockstar's YouTube channel. It is something to watch, not a download.
None of that changes the confirmed record, which has not moved. On Take-Two's August 7 earnings call, CEO Strauss Zelnick confirmed the two announced editions and noted that neither carries a paid early-access window. Security researchers at Malwarebytes and Hackread have separately traced the paid early-access pages, the ones pushing crypto checkouts and malware bait. Every false promise borrows the vocabulary of a real launch: VIP access, early build, private download, limited window, unlock code. It is built to feel familiar, then it points you at a wallet transfer, a login page, or a file.
The hard boundary to hold: as of today, the only real GTA VI purchases are through official preorder channels, and no announced version sells access before the November 19, 2026 launch. Rockstar has not announced a public beta, an Android build, a PC early unlock, a demo, a crypto checkout, or a torrent. Anyone claiming to hand you a playable early copy or a PC file is selling a scam, not a shortcut.
The Next Vice rule stays simple. Start with Rockstar, then check the PlayStation or Xbox store when the game is actually on sale. If a site, email, Discord message, or torrent claims to test, demo, or sell GTA VI before launch, close it. Do not log in with gaming credentials on a page you reached through a link. Do not mount an ISO, run an installer, or open a launcher for a game that is not out yet, no matter how official the file names look. If you already typed credentials somewhere suspicious, change that password and any account that shares it, turn on app-based two-factor rather than SMS, and run a full malware scan if you installed anything. And if you ran one of these fake installers, treat the machine as compromised rather than just cleaned, because a wiper in the bundle is not there to steal a password and leave quietly. Nobody legitimate is handing out a GTA VI build, demo, or early access right now, and the scammers are counting on the launch countdown to get you to forget that.