Scammers capitalize on GTA 6 hype to push malware and crypto cons
Scammers are offering supposed leaked builds, early copies and phone versions of Grand Theft Auto VI (GTA 6) weeks before the game’s November 19 launch, Netcraft warned in a new blog post.
Scammers are offering supposed leaked builds, early copies and phone versions of Grand Theft Auto VI (GTA 6) weeks before the game’s November 19 launch, Netcraft warned in a new blog post.
The company looked at GTA VI-themed domains that appeared between July 1 and October 27, 2026.
Most of the lures fell into four groups, with sites borrowing the name of popular GTA VI leaker CyberLeek, promising early access, advertising mobile versions that don’t exist, or giving the game away for free.
A wallet prompt on a page, it noted, is The leaker, an unidentified person or group, started publishing apparent GTA VI gameplay clips on August 18.
What CyberLeek released was footage and images, with no game for anyone to download, but that hasn’t stopped others from using the name; since the first clips surfaced, 121 newly registered domains have included cyberleek, 100 of them in August.
Some of these sites push malware or ask for money upfront.
Others hide the promised download or code behind a content locker, which sends visitors through surveys and offers that appear to earn the site operator affiliate revenue.
Netcraft said it checked what each page showed and asked for, without paying, completing offers or connecting a crypto wallet, and cautioned that the sites can change quickly.
In September, the outlet first reported on a supposed GTA 6 download, found by Huntress, that installed several remote access trojans, an infostealer and a Chaos ransomware variant used to destroy victims’ files.
At gta6cyberleek[.]com, a page made to look like Rockstar’s own offered a free download of a file called GTAVI.exe, which 34 of 68 security engines on VirusTotal flagged, mostly as a trojan.
Another site, cyberleek[.]click, assured visitors its launcher carried no malware or viruses, then asked them to send $100 in cryptocurrency to unlock the game.
Rockstar has announced GTA VI only for PlayStation 5 and Xbox Series X|S, with no PC version and no early release.
A polished preorder page and a familiar payment flow may be enough to persuade a user to pay for a version or access arrangement that the official release does not offer, Netcraft noted .
Fake offers of free GTA$, the in-game currency, will probably grow, and some could ask for Rockstar, PlayStation or Xbox logins under the pretext of applying a bonus.
What happened
Scammers are offering supposed leaked builds, early copies and phone versions of Grand Theft Auto VI (GTA 6) weeks before the game’s November 19 launch, Netcraft warned in a new blog post.
The company looked at GTA VI-themed domains that appeared between July 1 and October 27, 2026.
Most of the lures fell into four groups, with sites borrowing the name of popular GTA VI leaker CyberLeek, promising early access, advertising mobile versions that don’t exist, or giving the game away for free.
What changed
A wallet prompt on a page, it noted, is The leaker, an unidentified person or group, started publishing apparent GTA VI gameplay clips on August 18.
What CyberLeek released was footage and images, with no game for anyone to download, but that hasn’t stopped others from using the name; since the first clips surfaced, 121 newly registered domains have included cyberleek, 100 of them in August.
Who is affected
Some of these sites push malware or ask for money upfront.
Others hide the promised download or code behind a content locker, which sends visitors through surveys and offers that appear to earn the site operator affiliate revenue.
Why it matters
Netcraft said it checked what each page showed and asked for, without paying, completing offers or connecting a crypto wallet, and cautioned that the sites can change quickly.
In September, the outlet first reported on a supposed GTA 6 download, found by Huntress, that installed several remote access trojans, an infostealer and a Chaos ransomware variant used to destroy victims’ files.
Technical details
At gta6cyberleek[.]com, a page made to look like Rockstar’s own offered a free download of a file called GTAVI.exe, which 34 of 68 security engines on VirusTotal flagged, mostly as a trojan.
Another site, cyberleek[.]click, assured visitors its launcher carried no malware or viruses, then asked them to send $100 in cryptocurrency to unlock the game.
Response
Rockstar has announced GTA VI only for PlayStation 5 and Xbox Series X|S, with no PC version and no early release.
A polished preorder page and a familiar payment flow may be enough to persuade a user to pay for a version or access arrangement that the official release does not offer, Netcraft noted .
What security teams should do
Fake offers of free GTA$, the in-game currency, will probably grow, and some could ask for Rockstar, PlayStation or Xbox logins under the pretext of applying a bonus.
What remains unknown
Some sites hand out Android package (APK) files and tell users to allow installation from unknown sources, while others put the download behind a Human Verification popup that asks for an email address and other personal details.
Attribution
Help Net Security: Scammers are offering supposed leaked builds, early copies and phone versions of Grand Theft Auto VI (GTA 6) weeks before the game’s November 19 launch, Netcraft warned in a new blog post.