The Fake GTA 6 Demo Is Malware: What It Steals and What to Do

There is no GTA 6 demo. Rockstar has not announced one, has not released one, and has not announced a PC version of the game at all. Every website currently offering a "GTA 6 demo download" is offering something else — and in at least one documented case, that something is a password stealer.

Malwarebytes published the research on August 24. We have read it in full, and this is the plain-English version, plus exactly what to do if you already ran the file.

What Was Found

CONFIRMED. Malwarebytes identified a network of websites appearing in search results for a GTA 6 demo and impersonating Rockstar Games. One result advertised an "Official Download." Visitors following the "Play Now" links could end up downloading a file named gta6_installer.exe.

The sites are convincing because they copy something real. They reproduce Rockstar's genuine promotion for the August 27 Extended Look — the actual dates, the actual artwork, the actual announcement — and then add a "Play Now" button that Rockstar never made.

The malicious sample was first spotted on August 19, one day after the first Cyberleek material began circulating. That timing is the whole story: the fakes exist because the real leak created demand.

The Distinction That Matters Most

Leaked footage is not a leaked game.

Eight days of Cyberleek clips produced video. Video is not a build. Nobody outside Rockstar has a playable copy of GTA 6, and there is no unofficial distribution channel that could tell you which download is genuine — because none of them are.

CONFIRMED: the game is scheduled for November 19, 2026 on PlayStation 5 and Xbox Series X|S. Rockstar has not announced a PC version. There is therefore no PC build to leak, demo, beta, or early-access.

If a site is offering you one, the question isn't whether it's real. It's what it actually contains.

The 1.1 MB Tell

The executable delivered by these sites is 1.1 MB.

Malwarebytes made the point better than we could: the screenshot they took of the scam website was larger than the file the website was offering.

A modern AAA game cannot fit inside a 1.1 MB executable. We are not going to guess at GTA 6's real installation size, because Rockstar hasn't published one. We don't need to. The gap is not close.

This is the fastest check anyone can run. Look at the file size before you look at anything else on the page.

What the File Actually Is

CONFIRMED. The installer belongs to the Vidar family — a well-established infostealer that is sold as a service to criminals rather than something built specifically for this campaign. That distinction matters: this is a rented tool pointed at a trending search term. It could be pointed at anything. This week it's pointed at GTA 6.

In this sample, Malwarebytes observed it looking for:

• Saved passwords and login details
• Session cookies
• Browsing and download history
• Autofill and other saved browser profile data
• Credentials stored by FTP clients

Their analysis showed 19 browser targets, including Chrome, Edge, Firefox, Brave, Opera and Vivaldi. It also searched Thunderbird profile directories, and targeted Perplexity's Comet browser and the WebView2 browser embedded inside Roblox Studio.

What that adds up to, in normal English: anything your browser logs you into without asking is on the list.

The Part Almost Nobody Is Covering

Modern browsers have made it genuinely harder for unrelated software to copy a password database and decrypt it. Chromium-based browsers in particular.

So this sample didn't try.

CONFIRMED — from the Malwarebytes behavioural analysis: it launched the real Chrome, Edge and Firefox executables already installed on the machine. It started them in headless mode, disabled logging, and pointed each one at a temporary user-data directory. Then it deleted those temporary directories afterward.

It wasn't running a fake browser. It was using the legitimate browser binaries the system already trusts — working through a process that is allowed to reach its own protected data, rather than attacking that protection from outside.

OUR TAKE: this is the detail that should end the "I'd notice if something was wrong" argument. Browser encryption is real and it works. It just cannot make running an unknown executable safe, because the executable can ask the browser nicely.

Why It Looked Like Nothing Happened

CONFIRMED. Malwarebytes reported no persistence mechanism in this sample — no startup entry, no scheduled task, no installed service that would relaunch it after a reboot. It produced no visible window and installed nothing a user would normally notice.

From the victim's perspective, the fake GTA 6 installer may simply appear to do nothing at all.

And it doesn't need to stay. Once passwords and session tokens have been taken, attackers can keep trying to use them long after the file itself is gone.

OUR TAKE: this is the most dangerous fact in the entire report. Most people who ran this file concluded it was a dud and moved on. A dud and a successful theft look identical from the desktop.

Why Changing Your Password May Not Be Enough

This is the section to read twice.

When you sign in to a website, the site hands your browser a session token — proof that you already authenticated. It's why you don't retype your password on every page.

If an attacker steals a usable session token, they may be able to reuse that authenticated session without going through the login process again.

That has consequences for two-factor authentication. 2FA protects the login. But a stolen session was created after that login already succeeded. Depending on the service and its own security controls, an attacker may be able to reuse the session without ever being asked for a password or a code.

So a password change, on its own, does not necessarily invalidate every existing session.

To be precise, because precision matters here: this does not mean every stolen cookie automatically defeats every website's security. Services handle session invalidation differently, and many will kill sessions on a password reset. It means you cannot assume it. You have to actually sign out everywhere.

And one more thing. If the machine is still compromised, typing your new passwords into that machine can expose the new passwords too. Clean the device first, or use a different one.

If You Ran One of These Installers

Assume credentials and active browser sessions on that computer may have been taken. Work through this in order.

1. Scan the affected computer with a trusted security product and remove what it finds.
2. Change important passwords from a clean device — a different computer or your phone, not the machine you're cleaning. Start with your primary email, because it's the reset key to everything else. Then banking and payment services, then accounts tied to your identity.
3. Sign out of active sessions everywhere you can. Look for "sign out everywhere," "log out of all devices," or "active sessions." This is the step that deals with stolen session cookies. Skipping it is the mistake.
4. Check your accounts for changes you did not make — new email forwarding rules, unfamiliar recovery addresses or phone numbers, authorised apps you don't recognise, devices you've never used.
5. Enable two-factor authentication anywhere it isn't already on.
6. Monitor the important accounts closely for the next several weeks.

Check your gaming accounts too. Steam, Epic, Rockstar Social Club, PlayStation and Xbox accounts can hold saved payment methods, purchase history, and inventories with real resale value attached. On a site about making money in GTA, it's worth saying plainly: the account you use to play is a financial account.

If the machine is badly compromised or you're not confident, get professional help. An article is not incident response, and pretending otherwise would be its own kind of dishonesty.

A Second, Separate Fake: The 113GB Torrent

This is a different threat from the one above, and we're keeping them separate on purpose.

Alongside the fake demo sites, fake GTA 6 downloads have been circulating on torrent and piracy sites. Security Affairs reported on one specific example: a 113GB file claiming to be a playable GTA VI build.

An independent researcher who analysed it found that almost all of that 113GB was empty padding — reportedly around 99.99% zeroes — wrapped around a tiny payload of roughly 50KB. RUMOR — this is independent analysis reported by Security Affairs and Tom's Hardware, not a vendor threat report.

Per that analysis, the decompiled code contained commands to exclude the entire C: drive from Windows Defender and shut down security software — a step that would prepare the machine before anything else ran.

Why the padding? A 50KB file called "GTA 6" is obviously fake. A 113GB file feels like a real game. The empty space is the disguise.

To be exact about attribution: the Defender exclusion behaviour belongs to this torrent, not to the gta6_installer.exe sample Malwarebytes analysed. Two different fakes, two different methods, one shared cause.

How to Spot the Next One

There will be a next one. Thursday's Extended Look guarantees another traffic spike, and another round of fake pages built to catch it.

• Check the file size first. One megabyte is not a game. Neither is a 113GB file of zeroes, but that one takes analysis — the small file takes a glance.
• Download only from official sources. The publisher's own site, Steam, Epic, PlayStation Store, Xbox.
• Don't trust search results. Attackers buy ads and optimise pages for exactly the terms people search during a news event. A top result is not a credential.
• Don't trust appearances. Logos, screenshots, layouts and brand colours are trivial to copy. These sites copied Rockstar's real announcement word for word.
• Be especially careful with anything framed as "leaked." By definition there is no official channel to tell you which leaked download is genuine — and in this case, none of them are.
• Never run an executable because a viral post says it contains leaked GTA 6 content.

Malwarebytes published the malicious domains associated with this campaign, defanged here so nobody types one in by accident: gta6demo[.]asia, gta6demo[.]eu, gta6demo[.]us, rockstar-gta-6[.]com. Do not visit these. They are listed so you recognise the pattern, not so you check.

Where to Actually Watch GTA 6

CONFIRMED. Grand Theft Auto VI: An Extended Look premieres on Netflix on Thursday, August 27, and arrives free on Rockstar's official YouTube channel later the same day.

That's real footage, from Rockstar, at no cost, with no executable, no wallet address and no installer.

The entire fake-download economy exists in the gap between now and Thursday night. After the Extended Look airs, there is a legitimate place to see the game running — which is exactly what everyone downloading these files actually wanted.

The Verdict

• CONFIRMED: fake sites impersonating Rockstar delivered gta6_installer.exe via "Play Now" buttons, documented by Malwarebytes on August 24.
• CONFIRMED: the file is 1.1 MB and belongs to the Vidar infostealer family, sold as a service to criminals.
• CONFIRMED: Malwarebytes observed 19 browser targets and theft of saved passwords, session cookies, history and autofill data.
• CONFIRMED: the sample launched legitimate installed browsers in headless mode to reach protected data, rather than breaking browser encryption.
• CONFIRMED: no persistence mechanism and no visible window were observed. An infection can look like nothing happened.
• CONFIRMED: a password change does not necessarily invalidate existing sessions. Signing out everywhere is a separate, necessary step.
• CONFIRMED: Rockstar has announced no GTA 6 demo, no beta, and no PC version. The game ships November 19, 2026 on PS5 and Xbox Series X|S.
• CONFIRMED: the Extended Look premieres August 27 on Netflix, then free on Rockstar's YouTube channel.
• RUMOR: the separate 113GB torrent analysis, including the Windows Defender exclusion commands. Independent research reported by Security Affairs and Tom's Hardware.
• OUR TAKE: the invisibility is the most dangerous part. A file that appears to do nothing is a file most people stop worrying about.
• OUR TAKE: your gaming accounts are financial accounts. Treat them like it.

Sources

• Malwarebytes, "Fake GTA 6 Extended Look and demo sites deliver an infostealer," Stefan Dasic, August 24, 2026
• Security Affairs, "Cybercriminals Turn GTA VI Leaks Into Malware Bait," Pierluigi Paganini, August 24, 2026
• Tom's Hardware, reporting on the 113GB fake ISO analysis

We've covered the real leak every day since August 18, and this is where that story ends: with clips, not a build. Join free and we'll send the Extended Look breakdown the night it airs.

Before you download anything, read these:

GTA 6 Gameplay Leak: Everything Real, and the Scam Attached

How to Spot a Fake GTA 6 Leak

GTA 6 Extended Look: What to Expect on August 27