The GTA VI scam cycle has picked up again as we close in on November 19, and the disguises keep getting sharper. Two versions are live at the same time: one sells you a copy of the game that does not exist, and one hands you a "demo" that quietly empties your browser. Both are counting on the same thing, which is that a launch this big makes people search for things Rockstar never offered.
The scam page tracked on September 1 is the paid version. Security researchers and outlets flagged a site at latestgta6[.]com claiming to sell a copy of the unreleased game "stolen" by CyberLeek, the group behind the leaked test-build footage. The bait price was around $50. Antivirus provider Malwarebytes flagged the site as one designed to drain cryptocurrency wallets. It is an escalation of a pattern that has run all summer: every leak wave spawns paid "leaked copy" and crypto-checkout pages within days.
That wallet-drainer page deserves a closer look, because it is the most technically capable version of this con so far. Malwarebytes' writeup describes a site dressed as a GTA VI countdown page, complete with a live timer to November 19, a Leonida map, and a grid of release facts that match Rockstar's real announcements. Two purchase buttons sit on top of all that accurate material: one sells a "leaked copy" for $50, the other offers the same thing for one SOL, roughly $102 at the time. The page even warns visitors that every other site selling leaked material is a scam and that this one is the only safe place to buy, which is a standard move to reassure anyone already suspicious. Then it contradicts itself. Its own footer says it offers no purchase, download, or payment of any kind, directly under two payment buttons. The facts grid says console-only while the FAQ promises a PC download after purchase, and the sales copy mixes up GTA IV with GTA VI. The working theory is that a legitimate fan template got reused and the pitch bolted on by someone who never proofread it.
What happens if you connect a wallet is the part that makes this worse than a paid-access con. The page does not charge the advertised price at all. Malwarebytes found code that checks the wallet balance, leaves a small amount behind to cover the transaction fee, and prepares to move everything else to the attacker. A second script, around 2.4 MB, wraps a legitimate wallet-connection tool with malicious code that inventories the wallet, values the holdings, reports back, and then asks the victim to approve transfers. It is built to reach across seven networks, including Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base, and Fantom, and it can either move assets immediately or take permission to move tokens and entire NFT collections later. Before any of that, the script pulls its settings from the operator's server and uses the visitor's IP to block a list of countries, then redirects them to a blank page. That regional exclusion is a familiar convention in criminal tooling, usually read as an attempt to avoid local law enforcement.
The download version is quieter, and it is the one you can still run into this week. Malwarebytes published a full teardown on August 24 of a network of sites impersonating Rockstar, and the detail that makes it worth re-reading now is what is inside the file. The pages copy Rockstar's genuine promotional material for the August 27 Extended Look, then add a "Play Now" button. Follow it and you get gta6_installer.exe, a file that Malwarebytes attributes to the Vidar family, a long-running information stealer sold as a service to other criminals. There is no demo inside it. There is no game. It is built to take what your browser remembers for you.
The first thing worth knowing is that a stolen session does not need your password. When you sign in to a site, your browser gets a session token that says you already authenticated. That is why you are not typing a password on every page. If a stealer copies that token, an attacker can often reuse the session without going through the login screen at all, which means two-factor authentication does not necessarily stand in the way. Two-factor protects the login. It does not protect a session that was created after the login already succeeded. This is also why changing your password after an infection may not be enough on its own, and why the step people skip, signing out of active sessions everywhere, is the one that matters most.
Vidar goes after the browser specifically. Malwarebytes found 19 browser targets, including Chrome, Edge, Firefox, Brave, Opera, and Vivaldi, plus Thunderbird profile directories, Perplexity's Comet browser, and the WebView2 browser embedded inside Roblox Studio. That last one is a reminder that gaming clients hold credentials too. The second detail is that it uses your own browser to get at that data. Chromium browsers have made it harder for unrelated software to copy a password database and decrypt it from outside. So the sample launches the real Chrome, Edge, and Firefox binaries already installed on the machine, runs them in headless mode pointing at a temporary profile directory, and works through a process those browsers already trust. When it is finished, it deletes the temporary directories it created. The protection was not broken. It was walked around by software the system allows to use it.
The third detail is how it stays reachable. Vidar has a documented habit of using dead-drop resolvers, which means the command address is not permanently baked into the file. Instead the sample reads its current destination from attacker-controlled profiles on legitimate services, and Malwarebytes observed Telegram, Steam, Twitter, Pinterest, and Steam Community profiles being used this way. The practical effect is that blocking one address does little, because the operator can point the profile somewhere new without rebuilding the malware.
Nobody should expect to notice it running. Malwarebytes found no persistence mechanism, no startup entry, no scheduled task and no installed service, and no visible window at all. From the victim's side, running the fake installer may look like the game failed to launch. An infostealer does not need to stay on the machine to do lasting damage, because credentials and session tokens keep working after the file is gone.
That is the same pattern cybersecurity firm Huntress documented in more brutal form on September 9, when it published the first detailed teardown of a fake build's payload. The sample arrived as an ISO, the disc image a real modern release would realistically ship in. Mount it and you get gta6installer.exe wearing a Grand Theft Auto V icon, an odd detail that should stop anyone cold. Run it and an installer appears with a message in Russian explaining that the product is an unlicensed leaked copy, that the game may not start, and that a "License not found" error means the crack has been fixed. There is even an email address for a working crack. The error is not a bug. It is scripted, shown on purpose so a failed install feels plausible while the real payload installs behind it.
What Huntress found inside that ISO is worth reading twice. The package carries a fake installer, several remote access trojans, an infostealer, ransomware being used as a wiper, and a web browser. Files land in the TEMP folder with reassuring names like rockstar.exe, steam.exe, rockstargames.exe, and rockstargamescrashfixer.exe. Three copies of NJRAT open a shell on the machine, log keystrokes, reach the camera, pull saved browser passwords, and grab cryptocurrency details. A second trojan, DCRAT, installs under a hidden name and edits the Windows hosts file to cut off antivirus reporting and telemetry, which is how a machine goes quiet after it is owned. A third tool, the Mercurial Grabber infostealer, sweeps up Discord tokens, Chrome passwords and cookies, Roblox Studio cookies, Minecraft session data, and Windows product keys, then ships them out over a Discord webhook. Huntress notes many of those files date back to 2023, old malware repurposed for a new audience, and that the campaign appears aimed at Russian gamers based on the installer language and the ransom note.
Huntress flagged the scale trick behind it too. Some of these ISOs top 100GB, but the size is fake: the file is padded with junk data to look like a real AAA install while the actual malicious payload is a fraction of that. Distribution is not subtle either. Huntress says it has seen SEO poisoning built to rank high in searches for a leaked copy, plus ISOs posted on gaming forums, social media, and torrent sites. The old advice about checking the file size only half works here. A hundred gigabyte download proves nothing, because the padding is the point.
Both families lean on the same weakness: search results. The fake demo sites were convincing enough to appear in Google alongside legitimate GTA VI coverage, and the pages borrow real artwork, real logos and the real promotional language for a real announcement. What none of them have is a file that makes sense. The Malwarebytes sample is 1.1 MB, which is not a compressed game, not a demo, and not a launcher. It is slightly smaller than a screenshot of the site that hosted it. No AAA release ships that way. Rockstar's own Extended Look runs about an hour and is a video to watch on Netflix or YouTube, not a file to install.
All of this shares one boundary, and Huntress states it plainly: there is no official GTA VI demo, and no real leaked, playable copy of the game is being distributed. The leaked footage and the map image that set this off are real leaks, but they are not a playable build, and the group behind them has not released anything you can run. So any "playable build," "demo," "leaked copy," or "PC download" that shows up online is not what it claims to be. Rockstar has not announced a GTA VI demo, a PC version, a beta, a technical preview, or an early-access offering.
None of that changes the confirmed record, which has not moved. On Take-Two's August 7 earnings call, CEO Strauss Zelnick confirmed the two announced editions and noted that neither carries a paid early-access window. Security researchers at Malwarebytes and Huntress have separately traced the paid early-access pages, the crypto checkouts, and the fake builds. Every false promise borrows the vocabulary of a real launch: VIP access, early build, private download, limited window, unlock code. It is built to feel familiar, then it points you at a wallet transfer, a login page, or a file.
The hard boundary to hold: as of today, the only real GTA VI purchases are through official preorder channels, and no announced version sells access before the November 19, 2026 launch. Rockstar has not announced a public beta, an Android build, a PC early unlock, a demo, a crypto checkout, or a torrent. Anyone claiming to hand you a playable early copy or a PC file is selling a scam, not a shortcut.
The Next Vice rule stays simple. Start with Rockstar, then check the PlayStation or Xbox store when the game is actually on sale. If a site, email, Discord message, or torrent claims to test, demo, or sell GTA VI before launch, close it. Do not log in with gaming credentials on a page you reached through a link. Do not connect a crypto wallet to any page promising a leaked copy, however polished the countdown timer looks. Do not mount an ISO, run an installer, or open a launcher for a game that is not out yet, no matter how official the file names look. If the file already ran, change the important passwords from a different device, then sign out of all active sessions rather than only changing the password, check your account recovery settings for anything you did not add, and scan the machine. Assume the credentials and the sessions on that computer may already be compromised, because a wiper in the bundle is not there to steal a password and leave quietly. Nobody legitimate is handing out a GTA VI build, demo, or early access right now, and the scammers are counting on the launch countdown to make you forget that.