Cybercriminals are abusing excitement around the upcoming release of Grand Theft Auto VI to spread malware disguised as leaked game files.
Fake GTA 6 ISO downloads, promoted through search results, torrent sites, gaming forums, and social media, are delivering password stealers, remote-access trojans (RATs), and file-wiping malware.
There is currently no legitimate playable GTA 6 demo or leaked full version available online. Attackers exploit this demand by offering large ISO files, sometimes exceeding 100GB, to make them appear realistic.
Most of the file is useless filler data, while the actual malicious payload is small and hidden inside the fake installer.
Fake GTA 6 Scams
The malicious ISO includes a file named gta6installer.exe, which uses a GTA 5-style icon to appear legitimate. When opened, it displays a Russian-language message claiming the game is an unlicensed leaked build.
It warns users that they may see a “License not found” error and provides an email address for a supposed crack update.
This message is part of the scam. After the installer runs, it drops multiple files into the Windows %TEMP% directory, including executables named rockstar.exe, steam.exe, licensechecker.exe, gta6.exe, and adminapp.exe.
A batch file named checkinternetconnection.bat launches Microsoft Edge and contacts clck[.]ru/34uJnp to confirm that the infected system has internet access. It then launches several malware components.
Three files deploy NJRAT, a widely used remote-access trojan. NJRAT can log keystrokes, steal browser credentials, capture screenshots, access webcams, download or upload files, modify the registry, and collect cryptocurrency-related data.
The RAT samples create firewall rules and communicate with AWS-hosted IP addresses and an ngrok tunnel.
Another file installs DCRAT, which provides attackers with remote control over the infected device. Its capabilities include screenshot capture, clipboard monitoring, mouse control, registry access, audio-device discovery, and window tracking.
DCRAT also modifies the Windows hosts file to block telemetry and reporting services linked to security products and online platforms.
The ISO also contains adminapp.exe, identified as the Mercurial Grabber infostealer.
This malware targets Chrome passwords and cookies, Discord tokens, Roblox Studio cookies, Minecraft session data, Windows product keys, screenshots, system details, IP addresses, and location information. Stolen data is sent to an attacker-controlled Discord webhook.
The most damaging payload is a Chaos ransomware variant launched through gta6.exe. Instead of demanding payment, the malware appears designed to permanently destroy files, huntress said.
Indicators of Compromise (IOCs)
| IOC Type | Indicator | Details / Malware Association |
|---|---|---|
| File | Gta6installer.exe | Initial fake GTA 6 installer executable |
| MD5 | a15e280a3fd65dfaa243bbe2dbf45e97 | Hash of Gta6installer.exe |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
