Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware

Cybercriminals are exploiting intense interest in Grand Theft Auto VI by pushing fake game downloads that install several types of malware instead of a playable game. The campaign targets people looking for an early build, leaked copy, or unofficial demo before the title’s release.

The malicious downloads are distributed through poisoned search results, gaming forums, torrent sites, and social-media posts. Some of the fake ISO files exceed 100GB, but the large size is mainly junk data intended to make the download appear believable.

Analysts at Huntress identified a sample that combined remote-access malware, an information stealer, file-destroying ransomware, and an extra web browser in one package.

The use of Russian-language prompts and a Russian ransom note suggests the operation may be aimed primarily at Russian-speaking gamers.

Huntress said in a report shared with Cyber Security News (CSN) that the campaign abuses the absence of any legitimate GTA 6 demo or leaked playable build.

The case shows how a high-profile game release can turn ordinary searches into a route for device compromise, similar to earlier fake GTA 6 demo malware activity targeting eager players.

Fake GTA 6 Downloads Deliver Multiple Threats

The infection begins when a victim mounts the fake game image and launches what appears to be an installer. The main program uses an older GTA 5-style icon, then displays a Russian message warning that the supposed leaked game may fail because its crack is no longer valid.

That warning is part of the deception. Once the installation finishes, victims see a “license not found” error, giving them a believable reason why the game did not open while malware runs quietly in the background.

This approach helps attackers delay suspicion and gives their payloads more time to operate. The package drops several files into the Windows temporary folder and checks whether the device can reach the internet before continuing.

It then installs multiple copies of NJRAT, a remote-access tool that can let an attacker record keystrokes, capture screenshots, access webcams, browse files, steal browser data, and remotely control the system.

The attackers also deploy DCRAT, another remote-access tool that can monitor windows, capture the clipboard, discover audio devices, and change registry settings.

It changes the Windows hosts file to block selected telemetry and security-reporting services, a tactic that may reduce the chance of the infection being noticed or reported.

A separate component, Mercurial Grabber, collects browser passwords and cookies, chat-platform tokens, game-related session data, screenshots, system details, location information, and Windows product keys.

The campaign reflects the same broad risk seen in SEO poisoned download campaigns, where trusted-looking search results lead users to weaponized installers.

Ransomware Used as a Wiper

The most damaging part of the package is Chaos ransomware, although the operators do not appear interested in collecting payment.

Instead, the malware acts like a wiper by encrypting smaller files and overwriting files larger than 200MB with random data, making them effectively unrecoverable.

If the infected user has administrator rights, the malware deletes shadow copies and disables recovery options before starting file destruction.

It targets common personal folders, shared data locations, saved games, and cloud-synchronised storage, creating a damaging outcome that can extend beyond the device itself.

The ransomware leaves a note claiming files have been encrypted forever, rather than giving victims a genuine recovery path.

That behavior makes the campaign especially dangerous for gamers who may expect only password theft but instead lose documents, photos, game saves, and locally stored work files.

Users should avoid alleged unreleased games, pirated installers, and download pages promoted through unfamiliar search results.

Search-result manipulation remains a recurring delivery method, as shown by malicious software search results that imitate legitimate download sources to lure Windows users.

Anyone who ran a suspected GTA 6 installer should immediately disconnect the device from the network, reset passwords from a clean device, enable two-factor authentication, and perform a full system reinstallation.

Keeping security protections updated can also help detect the older malware families used in this operation. The campaign is a reminder that popular games create a ready-made social-engineering opportunity.

Players should wait for announcements and downloads from official publisher channels, rather than trusting leaked-build claims, torrent listings, or posts promising early access.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.