Cybercriminals are exploiting the enormous hype around Grand Theft Auto VI by setting up fake Rockstar websites that offer what appears to be a playable GTA 6 demo but in reality delivers password‑stealing malware. Security firm Malwarebytes says there is no legitimate GTA 6 demo, and that the “installer” being promoted through these spoofed sites is an information‑stealing Trojan.
The campaign capitalizes on the long wait for GTA 6, the decade since GTA 5’s release, and repeated delays that have left fans hungry for any early look at the game. Rockstar’s next mainline entry in the Grand Theft Auto series is currently scheduled to launch on November 19, 2026, for PlayStation 5 and Xbox Series X|S, with no PC release yet announced.
Fake GTA 6 Demo Websites Impersonate Rockstar
According to Malwarebytes, attackers have built a network of fake websites that impersonate Rockstar’s official online presence and are optimized to appear in searches for “GTA 6 demo,” “GTA 6 extended look,” and similar terms. One such site even appears as a sponsored or high‑ranking result claiming to host an “Official Download” for the upcoming game.
These pages closely copy Rockstar’s genuine branding and promotional materials, including references to the real “Extended Look” at GTA 6 that Rockstar is premiering on Netflix on August 27. The fraudulent pages feature a prominent “Play Now” button, which prompts users to download an executable named gta6_installer.exe.
Instead of a demo or game build, that file is a malicious information stealer, designed to grab passwords, cookies and active browser sessions from an infected machine. Malwarebytes notes that the installer is just 1.1 MB in size, far too small to contain any modern AAA game, which is one of several red flags users could spot if they looked closely.
No Official GTA 6 Demo Exists
Both Rockstar’s public announcements and Malwarebytes’ analysis emphasize that no official GTA 6 demo currently exists. The only confirmed upcoming preview is the Extended Look video that will stream on Netflix on August 27 and then appear on Rockstar’s YouTube channel, which is a video showcase, not a playable build.
“Rockstar has not announced or released a demo of Grand Theft Auto VI,” Malwarebytes writes, stressing that any website offering a GTA 6 demo or PC build is not legitimate. TechCrunch similarly notes that fans “are being targeted by cybercriminals in the real world” through fake sites that “advertise a playable GTA 6 demo — but no legitimate demo exists.”
This mismatch between fan expectations and the actual release plan creates fertile ground for scammers, who know that users searching for “early access,” “beta,” or “leaked builds” may be more willing to trust unofficial downloads.
Vidar Infostealer Targets Passwords, Cookies and Sessions
The malicious file delivered by these fake GTA 6 demo sites belongs to the Vidar family, a well‑known information‑stealing malware sold as a service to cybercriminals. Once executed, it silently looks for:
-
Saved passwords and login details stored by web browsers
-
Session cookies, which keep users logged in
-
Browsing and download history
-
Browser autofill data and profiles
-
Credentials stored by certain FTP clients and email clients such as Thunderbird
Malwarebytes’ analysis shows that this Vidar sample targets at least 19 different browsers, including Chrome, Edge, Firefox, Brave, Opera, Vivaldi, and even the WebView2 browser embedded inside Roblox Studio and Perplexity’s Comet browser. It does not display any visible windows or user‑facing indicators, and from a victim’s perspective, the supposed GTA 6 installer may simply appear to do nothing.
The malware does not appear to install a persistence mechanism—no startup entry, scheduled task, or service to relaunch itself after reboot—meaning it may disappear after a scan or restart. However, by that point it may already have exfiltrated passwords and reusable session tokens, which attackers can continue to use even after the malware is gone.
Session Theft Can Bypass Passwords and 2FA
A major concern highlighted by Malwarebytes is that session cookies can let attackers hijack accounts even if they do not know the victim’s password. When a user logs into a service, the site often issues a session token that tells the browser “this user is authenticated,” allowing them to stay logged in across pages without re‑entering credentials.
If Vidar steals a valid session token, it may be possible for attackers to reuse that session from another machine or environment, depending on how the service validates sessions and devices. Because the token was created after the user passed through the login process, including any multi‑factor authentication, using that token can sometimes bypass both passwords and 2FA prompts.
This is why Malwarebytes warns that changing passwords alone may not be enough after an infostealer infection. Users should also use account security tools such as “sign out of all devices,” “log out of all sessions,” or equivalent features that explicitly revoke existing sessions.
Scam Exploits Genuine GTA 6 Leaks and Hype
The fake GTA 6 demo campaign emerged in the wake of a new wave of GTA 6 leaks that began circulating online around August 18, including gameplay clips and what appears to be a complete map of Leonida, the game’s setting. A group calling itself Cyberleek claimed responsibility, and some of the leaked clips carried promotions for a cryptocurrency token tied to the group.
This is not the first time GTA 6 has been at the centre of a major leak: in 2022, Rockstar confirmed that an attacker had stolen and published early development footage, prompting wide coverage and further fuelling the appetite for unofficial content. Malwarebytes notes that this kind of environment—where real, fake, and semi‑legitimate leaks coexist—is ideal for malware campaigns masquerading as rare or exclusive downloads.
Technical Infrastructure Behind the GTA 6 Malware Campaign
The GTA 6 demo scam uses several domains to lure victims. These sites distribute the same malicious executable and share infrastructure associated with Vidar campaigns.
Vidar often employs so‑called “dead‑drop resolvers”, where the malware retrieves its command‑and‑control information from attacker‑controlled profiles on legitimate platforms such as Telegram, Pinterest and Steam Community. In this case, the sample contained profile URLs for all three services and was observed connecting to them during analysis
The malware also reached out to dedicated attacker infrastructure. Using a mix of legitimate platforms and rapidly rotating domains makes it harder for defenders to block all possible routes the malware might use to exfiltrate data or receive instructions.
How GTA Fans Can Stay Safe from Fake GTA 6 Demos
Security experts are urging players to treat any GTA 6 download offer with extreme skepticism, especially while the game is still in development and Rockstar has not announced a demo. Malwarebytes and TechCrunch both provide practical guidance to avoid falling for campaigns like this.
Key recommendations include:
-
Check official sources first. Verify any claimed demo, beta or “extended look” against announcements on Rockstar’s official site and its verified social channels.
-
Use official distribution platforms. Only download games and demos from trusted marketplaces such as the PlayStation Store, Xbox Store, Steam, Epic Games Store or Rockstar’s own launcher.
-
Be suspicious of file size. A 1 MB executable cannot contain a modern open‑world game; anything that small advertised as a GTA 6 demo is almost certainly not genuine.
-
Don’t trust search results alone. Attackers can buy ads and search‑optimise malicious pages so they appear prominently for terms like “GTA 6 demo” or “GTA 6 PC early access.”
-
Beware of look‑alike sites. Logos, artwork and layouts are easy to copy; a familiar visual design is not proof that a site is official.
If a user suspects they may have run the fake installer, Malwarebytes recommends immediately scanning the affected system with a reputable security tool, changing passwords from a clean device (starting with email, banking and critical accounts), revoking active sessions and monitoring for unusual activity.
With GTA 6 now officially slated for November 19, 2026, and a Netflix Extended Look on the way, security experts say the safest way to experience the next Grand Theft Auto is simply to wait for Rockstar’s own releases—and to resist the temptation of any “too good to be true” demo that appears in the meantime.
