Bogus GTA 6 downloads plant credential-stealing malware

Cybercriminals are distributing fake Grand Theft Auto VI downloads that install remote-access trojans, an information stealer and destructive ransomware, putting gamers’ passwords, Discord accounts and cryptocurrency data at risk.

Cybersecurity firm Huntress said it identified malicious optical-disc image files masquerading as leaked copies of Rockstar Games’ forthcoming title across search results, gaming forums, social media and torrent sites. Some files exceed 100GB, but researchers found much of the size was junk data intended to make the download resemble a genuine blockbuster game package.

The malicious ISO examined by Huntress contains a fake installer named gta6installer. exe, several copies of the NJRAT remote-access trojan, DCRAT, the Mercurial Grabber infostealer, a Chaos ransomware variant and a Yandex Browser installer. The bundle appears designed to compromise as much of an infected Windows system as possible rather than rely on a single payload.

Running the installer triggers a Russian-language message claiming the supposed game is an unlicensed leaked version and warning that it may fail to start. The setup later produces a “license not found” message, giving victims a plausible explanation for the missing game while malicious components execute in the background.

Huntress said multiple NJRAT instances can log keystrokes, access connected cameras, steal browser credentials, capture screenshots, modify files and processes, and collect cryptocurrency-related information. Some components create Windows Firewall rules and communicate with infrastructure hosted on cloud services and through secure tunnelling networks.

A separate DCRAT installation gives attackers broader control of the compromised machine, including clipboard access, mouse control, screenshot capture, audio-device discovery and registry access. Researchers also observed one component altering the Windows hosts file to block or redirect connections associated with telemetry and security products.

Mercurial Grabber, installed as adminapp. exe, targets account and gaming data. Huntress found that it can collect Discord authentication tokens, Google Chrome passwords and cookies, Roblox Studio cookies, Minecraft session information, Windows product keys, screenshots, system information, IP addresses and geolocation data. Stolen information is then sent through a Discord webhook controlled by the attackers.

The most destructive element is a variant of Chaos ransomware that Huntress assessed as being used as a wiper rather than for extortion. The malware requires administrator privileges, deletes Windows shadow-copy backups, disables recovery options and changes boot settings before damaging user files.

Files of 200MB or less are encrypted using AES and given random extensions, while larger files are overwritten with random data, making them effectively unrecoverable. The malware targets non-system drives before moving through common Windows folders including Desktop, Documents, Downloads, Pictures, Music, Saved Games and OneDrive locations. It leaves a ransom note but provides no working payment mechanism.

The package also installs Yandex Browser for reasons that remain unclear. Huntress said the Russian language used by the installer and other artefacts, together with the presence of the browser, may indicate that the sample was initially aimed at Russian-speaking users, although the distribution channels could expose a wider audience.

Rockstar Games says Grand Theft Auto VI is scheduled for release on November 19, 2026, for PlayStation 5 and Xbox Series X|S. Official pre-orders are already available, while pre-loading is due to begin on November 12. Rockstar’s official support material does not list a PC edition or any playable public demo.

That gap creates an opening for criminals to exploit players searching for unofficial early access. Huntress said it had seen search-engine optimisation poisoning intended to push malicious download pages higher in results, alongside posts promoting fake images on forums, social platforms and torrent sites.

The lure carries several signs of deception. Huntress noted that the main executable uses a Grand Theft Auto V icon rather than artwork from the new title, while the installer asks users to contact an email address if the supposed crack fails. Researchers found no evidence that a leaked build was circulating through those channels.