Attackers targeting Rockstar Games have exploited trusted identities, employee authentication prompts, and third-party access rather than relying only on software vulnerabilities, according to a technical analysis published by security firm Lares.
The report connects several incidents to weaknesses in identity controls, internal access, and data monitoring.
Written by Andrew Heller and published on September 1, 2026, the analysis examines the 2022 Lapsus$ intrusion, an April 2026 ShinyHunters compromise, and an alleged August 2026 development build leak linked to Cyberleek.
Its central warning is simple: legitimate access can become an attack path when credentials or tokens fall into hostile hands.
Hackers Bypass Rockstar Defenses
According to Lares, the September 2022 Lapsus$ attack used valid corporate credentials and MFA fatigue. This technique involves sending repeated authentication requests until an employee approves one, allowing the attacker to complete a login without defeating the authentication system itself.
The report says attackers then moved through Slack and Atlassian Confluence, using internal search features to find exposed credentials, API keys, and server addresses.
It links the intrusion to approximately 90 stolen development videos and proprietary source code. These detailed attack-chain claims are attributed to Lares rather than independently established here.
The April 2026 incident followed a different route. Lares reports that ShinyHunters compromised analytics provider Anodot, extracted long-lived OAuth tokens, and used them to access Rockstar’s Snowflake environment. The analysis places the reported data theft at 78.6 million records.
Bearer tokens grant access to whoever possesses them. In the reported attack, stolen integration tokens therefore served as machine credentials, letting attackers approach the data warehouse through an existing trusted connection. Lares identifies the absence of cryptographic token binding as a key weakness.
Unlike employee authentication abuse, this pathway targeted a non-human identity. The distinction matters because securing user logins alone would not address an integration that continues accepting stolen tokens.
Lares also describes an August 2026 campaign attributed to Cyberleek, involving gameplay footage, mapping information, and claims of a playable GTA VI development build.
The report says the actor promoted a cryptocurrency token and used stolen material to encourage participation in its leak campaign.
However, footage alone does not establish how an attacker obtained or executed a build. Lares presents several possible explanations, including bypassed checks, stolen source code, or a modified development environment. These remain alternative explanations, not a demonstrated initial access route.
The analysis recommends stronger separation between development systems and other internal services, alongside monitoring for unusual outbound transfers.
It also calls for scanning collaboration platforms for exposed secrets and watching service accounts for unexpected login locations or unusually large database queries.
For authentication, Lares recommends FIDO2 hardware keys instead of approval-based push prompts. For supported API integrations, it proposes proof-of-possession protections such as DPoP to reduce stolen token reuse.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
