The Fake GTA 6 Demo Is Malware: What It Steals

There is no GTA 6 demo. Rockstar has not announced one, has not released one, and has not announced a PC version of the game at all. Every website currently offering a "GTA 6 demo download" is offering something else, and in documented cases, that something is a password stealer, a crypto wallet drainer, or worse.

Malwarebytes published the first research on August 24. We have read it in full, and this is the plain-English version, plus exactly what to do if you already ran one of these files. This page is updated as new scam waves surface. The latest: a wallet-draining campaign documented September 1, and a new installer variant flagged in mid-September.

CONFIRMED. Malwarebytes identified a network of websites appearing in search results for a GTA 6 demo and impersonating Rockstar Games. One result advertised an "Official Download." Visitors following the "Play Now" links could end up downloading a file named gta6_installer.exe.

The sites are convincing because they copy something real. They reproduce Rockstar's genuine promotion for the August 27 Extended Look, the actual dates, the actual artwork, the actual announcement — and then add a "Play Now" button that Rockstar never made.

The malicious sample was first spotted on August 19, one day after the first Cyberleek material began circulating. That timing is the whole story: the fakes exist because the real leak created demand.

Weeks of Cyberleek clips produced video. Video is not a build. Nobody outside Rockstar has a playable copy of GTA 6, and there is no unofficial distribution channel that could tell you which download is genuine — because none of them are.

CONFIRMED: the game is scheduled for November 19, 2026 on PlayStation 5 and Xbox Series X|S. Rockstar has not announced a PC version. There is therefore no PC build to leak, demo, beta, or early-access.

If a site is offering you one, the question isn't whether it's real. It's what it actually contains.

The executable delivered by these sites is 1.1 MB.

Malwarebytes made the point better than we could: the screenshot they took of the scam website was larger than the file the website was offering.

A modern AAA game cannot fit inside a 1.1 MB executable. We are not going to guess at GTA 6's real installation size, because Rockstar hasn't published one. We don't need to. The gap is not close.

This is the fastest check anyone can run. Look at the file size before you look at anything else on the page.

CONFIRMED. The installer belongs to the Vidar family — a well-established infostealer that is sold as a service to criminals rather than something built specifically for this campaign. That distinction matters: this is a rented tool pointed at a trending search term. It could be pointed at anything. This week it's pointed at GTA 6.

In this sample, Malwarebytes observed it looking for:

• Saved passwords and login details
• Session cookies
• Browsing and download history
• Autofill and other saved browser profile data
• Credentials stored by FTP clients

Their analysis showed 19 browser targets, including Chrome, Edge, Firefox, Brave, Opera and Vivaldi. It also searched Thunderbird profile directories, and targeted Perplexity's Comet browser and the WebView2 browser embedded inside Roblox Studio.

What that adds up to, in normal English: anything your browser logs you into without asking is on the list.

Modern browsers have made it genuinely harder for unrelated software to copy a password database and decrypt it. Chromium-based browsers in particular.

CONFIRMED — from the Malwarebytes behavioural analysis: it launched the real Chrome, Edge and Firefox executables already installed on the machine. It started them in headless mode, disabled logging, and pointed each one at a temporary user-data directory. Then it deleted those temporary directories afterward.

It wasn't running a fake browser. It was using the legitimate browser binaries the system already trusts — working through a process that is allowed to reach its own protected data, rather than attacking that protection from outside.

OUR TAKE: this is the detail that should end the "I'd notice if something was wrong" argument. Browser encryption is real and it works. It just cannot make running an unknown executable safe, because the executable can ask the browser nicely.

CONFIRMED. Malwarebytes reported no persistence mechanism in this sample — no startup entry, no scheduled task, no installed service that would relaunch it after a reboot. It produced no visible window and installed nothing a user would normally notice.

From the victim's perspective, the fake GTA 6 installer may simply appear to do nothing at all.

And it doesn't need to stay. Once passwords and session tokens have been taken, attackers can keep trying to use them long after the file itself is gone.

OUR TAKE: this is the most dangerous fact in the entire report. Most people who ran this file concluded it was a dud and moved on. A dud and a successful theft look identical from the desktop.

This is the section to read twice.

When you sign in to a website, the site hands your browser a session token — proof that you already authenticated. It's why you don't retype your password on every page.

If an attacker steals a usable session token, they may be able to reuse that authenticated session without going through the login process again.

That has consequences for two-factor authentication. 2FA protects the login. But a stolen session was created after that login already succeeded. Depending on the service and its own security controls, an attacker may be able to reuse the session without ever being asked for a password or a code.

So a password change, on its own, does not necessarily invalidate every existing session.

To be precise, because precision matters here: this does not mean every stolen cookie automatically defeats every website's security. Services handle session invalidation differently, and many will kill sessions on a password reset. It means you cannot assume it. You have to actually sign out everywhere.

And one more thing. If the machine is still compromised, typing your new passwords into that machine can expose the new passwords too. Clean the device first, or use a different one.

CONFIRMED. On September 1, Malwarebytes documented a new campaign: a site offering a "leaked copy" of GTA 6 for PC, priced at $50 or 1 SOL (about $102 at the time). There is no download at all. Visiting the page loads wallet-draining scripts.

The analyzed page contained a Solana-specific component that inspected a connected wallet's SOL balance, reserved only enough for transaction fees, and constructed a transfer of essentially the remaining balance to a hard-coded receiving address. A second, heavier script targeted seven more blockchains — Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base, and Fantom — inventorying wallet assets and either draining them or requesting approval permissions to do it later. The site even geoblocked visitors from Russia, Belarus, Kazakhstan, and neighboring countries, a common way scam operators dodge law enforcement in jurisdictions where they might face consequences. CONFIRMED via Malwarebytes reporting covered by GTASixOnline.

This is the third iteration Malwarebytes has spotted this year: the first sold "early access" for several hundred dollars in crypto, the second disguised an infostealer as a playable demo, and this one skips the download entirely and goes straight for the wallet. CONFIRMED via WEEX.

Why this matters on a money site: the GTA audience overlaps heavily with crypto holders. If you connected a wallet to one of these pages, the fix is different from the infostealer above. Check your wallet's approved permissions and revoke anything you don't recognize, move remaining funds to a fresh wallet, and treat the old approvals as compromised. A password change does nothing here. There was never a password.

REPORTED. In mid-September, Huntress flagged a campaign hiding behind a fake GTA 6 installer delivered as gta6installer.exe. It promises a crack, shows an error message, and quietly leaves remote-access tools, an infostealer, and a wiper running in the background. The bait works because there is no official GTA 6 demo anywhere, and players are desperate to get one by any means. REPORTED via Esquire India.

Separately, Allure Security's September roundup catalogued the wider scam economy: 47 fake pre-order listings charging crypto for nonexistent beta access (identified by NordVPN), fake Rockstar Social Club login pages harvesting credentials, and fake GTA 6 mobile apps on third-party stores despite the game being console-only. REPORTED via Allure Security.

Assume credentials and active browser sessions on that computer may have been taken. Work through this in order.

1. Scan the affected computer with a trusted security product and remove what it finds.
2. Change important passwords from a clean device — a different computer or your phone, not the machine you're cleaning. Start with your primary email, because it's the reset key to everything else. Then banking and payment services, then accounts tied to your identity.
3. Sign out of active sessions everywhere you can. Look for "sign out everywhere," "log out of all devices," or "active sessions." This is the step that deals with stolen session cookies. Skipping it is the mistake.
4. Check your accounts for changes you did not make — new email forwarding rules, unfamiliar recovery addresses or phone numbers, authorised apps you don't recognise, devices you've never used.
5. Enable two-factor authentication anywhere it isn't already on.
6. If you connected a crypto wallet to a GTA 6 page, revoke its permissions. Check your wallet's approved dApps and token approvals, revoke anything unfamiliar, and move remaining funds to a fresh wallet.
7. Monitor the important accounts closely for the next several weeks.

Check your gaming accounts too. Steam, Epic, Rockstar Social Club, PlayStation and Xbox accounts can hold saved payment methods, purchase history, and inventories with real resale value attached. On a site about making money in GTA, it's worth saying plainly: the account you use to play is a financial account.

If the machine is badly compromised or you're not confident, get professional help. An article is not incident response, and pretending otherwise would be its own kind of dishonesty.

This is a different threat from the ones above, and we're keeping them separate on purpose.

Alongside the fake demo sites, fake GTA 6 downloads have been circulating on torrent and piracy sites. Security Affairs reported on one specific example: a 113GB file claiming to be a playable GTA VI build.

Independent analysis found that almost all of that 113GB was empty padding — around 99.99% zeroes — wrapped around a tiny payload of roughly 50KB. TechRadar confirmed the finding. CONFIRMED via TechRadar reporting covered by GTAIntel, originally Security Affairs and Tom's Hardware.

Per that analysis, the decompiled code contained commands to exclude the entire C: drive from Windows Defender and shut down security software — a step that would prepare the machine before anything else ran.

Why the padding? A 50KB file called "GTA 6" is obviously fake. A 113GB file feels like a real game. The empty space is the disguise.

To be exact about attribution: the Defender exclusion behaviour belongs to this torrent, not to the gta6_installer.exe sample Malwarebytes analysed. Different fakes, different methods, one shared cause.

A message attributed to the Cyberleek group's website began circulating in mid-September, claiming it has been "setting up a server to host the first GTA VI full build" and that a "dead man's switch" has been activated. No major outlet has confirmed it. There is direct precedent for caution: on August 23, Insider Gaming retracted its own report of a Cyberleek "release the build" threat after finding it "manufactured and circulated online by one of the many people copying or aping what Cyberleek is doing." UNVERIFIED — RUMOR via GTAIntel.

Why it matters here: whether or not the claim is real, it is already functioning as scam bait. Every "full build" rumor produces a fresh crop of download pages. Treat any site offering the build as hostile until proven otherwise. None have been proven otherwise.

There will be a next one. The 14-page Game Informer issue drops September 29, the album rollout is still unfolding, and the November 19 launch countdown guarantees another traffic spike — and another round of fake pages built to catch each one.

• Check the file size first. One megabyte is not a game. Neither is a 113GB file of zeroes, but that one takes analysis — the small file takes a glance.
• Never connect a crypto wallet to a GTA 6 page. No legitimate Rockstar or Take-Two page will ever ask you to. A wallet connection request on a fan page, leak page, or download page is the drainer loading.
• Download only from official sources. The publisher's own site, Steam, Epic, PlayStation Store, Xbox.
• Don't trust search results. Attackers buy ads and optimise pages for exactly the terms people search during a news event. A top result is not a credential.
• Don't trust appearances. Logos, screenshots, layouts and brand colours are trivial to copy. These sites copied Rockstar's real announcement word for word.
• Be especially careful with anything framed as "leaked." By definition there is no official channel to tell you which leaked download is genuine — and in this case, none of them are.
• Never run an executable because a viral post says it contains leaked GTA 6 content.

Malwarebytes published the malicious domains associated with the August campaign, defanged here so nobody types one in by accident: gta6demo[.]asia, gta6demo[.]eu, gta6demo[.]us, rockstar-gta-6[.]com. Do not visit these. They are listed so you recognise the pattern, not so you check. New domains appear with every wave.

CONFIRMED. Grand Theft Auto VI: An Extended Look aired August 27 on Netflix and is free on Rockstar's official YouTube channel.

That's real footage, from Rockstar, at no cost, with no executable, no wallet address and no installer.

The fake-download economy feeds on the gap between what people want to see and what they can officially see. Every news event — the Extended Look, the album, the Game Informer issue, the launch itself — produces a fresh wave of fakes. The legitimate footage is always free and never asks you to download or connect anything.

• CONFIRMED: fake sites impersonating Rockstar delivered gta6_installer.exe via "Play Now" buttons, documented by Malwarebytes on August 24.
• CONFIRMED: the file is 1.1 MB and belongs to the Vidar infostealer family, sold as a service to criminals.
• CONFIRMED: Malwarebytes observed 19 browser targets and theft of saved passwords, session cookies, history and autofill data.
• CONFIRMED: the sample launched legitimate installed browsers in headless mode to reach protected data, rather than breaking browser encryption.
• CONFIRMED: no persistence mechanism and no visible window were observed. An infection can look like nothing happened.
• CONFIRMED: a password change does not necessarily invalidate existing sessions. Signing out everywhere is a separate, necessary step.
• CONFIRMED: a September 1 wallet-drainer campaign offered a fake "leaked copy" for $50 or 1 SOL, loading Solana and multi-chain drainer scripts instead of any download.
• CONFIRMED: Rockstar has announced no GTA 6 demo, no beta, and no PC version. The game ships November 19, 2026 on PS5 and Xbox Series X|S.
• CONFIRMED: the 113GB torrent was ~99.99% empty padding around a small payload that disabled Windows security tools (TechRadar).
• RUMOR: the September 19 "full build" / "dead man's switch" message attributed to Cyberleek. Unverified by any major outlet.
• OUR TAKE: the invisibility is the most dangerous part. A file that appears to do nothing is a file most people stop worrying about.
• OUR TAKE: your gaming accounts are financial accounts. Treat them like it.
• OUR TAKE: the scammers follow the news cycle. Every reveal you cover is a reveal they'll weaponize. Check back here before you download anything tied to one.

• Malwarebytes, "Fake GTA 6 Extended Look and demo sites deliver an infostealer," Stefan Dasic, August 24, 2026
• Malwarebytes, September 1 wallet-drainer campaign analysis, via GTASixOnline
• Huntress, fake GTA 6 installer (RAT/infostealer/wiper) campaign, via Esquire India, September 2026
• Allure Security, "GTA 6 Scams Are Running. The Game Isn't," September 2026 (incl. NordVPN pre-order scam research)
• Security Affairs, "Cybercriminals Turn GTA VI Leaks Into Malware Bait," Pierluigi Paganini, August 24, 2026
• Tom's Hardware and TechRadar, reporting on the 113GB fake ISO analysis
• GTAIntel, "Where Is CYBERLEEK Now," September 2026

We've covered the real story since August 18, and the fakes since August 24. This page stays updated as new waves surface. Join free and we'll send the Day-One Money Plan before November 19.

GTA 6 Gameplay Leak: Everything Real, and the Scam Attached

How to Spot a Fake GTA 6 Leak

GTA 6 Extended Look: Every Confirmed Detail