Fake GTA 6 download goes after Steam logins and crypto wallet data
A Google Colab notebook promotes a fake GTA 6 executable download (Source: Cynet) Grand Theft Auto VI launches November 19 with no PC version.
A Google Colab notebook promotes a fake GTA 6 executable download (Source: Cynet) Grand Theft Auto VI launches November 19 with no PC version.
Any site offering a PC installer is offering something other than the game.
People searching for early access or a leaked build are the target, and this sample shows how much work the lure puts into keeping them clicking.
The README proves more: it tells the user to run the file as administrator, click past a security warning, and add an antivirus exclusion if the file is blocked.
Cynet named uroker[.]casa as the probable command-and-control server, which is the machine the stealer reports back to; it also listed 104.21.75[.]176 but warned against blocking that address because it is a shared Cloudflare IP.
The Colab link led to a page called Windows Software Hub, which showed a version number, a download count, and Virus Free, Secure, and Verified badges.
It checks whether it is running in a virtual machine or sandbox, injects code into browser processes, replaces cryptocurrency addresses copied to the clipboard, and can download more malware.
A download page and a file manager measure different things, so the size mismatch proves little by itself.
What happened
A Google Colab notebook promotes a fake GTA 6 executable download (Source: Cynet) Grand Theft Auto VI launches November 19 with no PC version.
Any site offering a PC installer is offering something other than the game.
People searching for early access or a leaked build are the target, and this sample shows how much work the lure puts into keeping them clicking.
What changed
The README proves more: it tells the user to run the file as administrator, click past a security warning, and add an antivirus exclusion if the file is blocked.
Cynet named uroker[.]casa as the probable command-and-control server, which is the machine the stealer reports back to; it also listed 104.21.75[.]176 but warned against blocking that address because it is a shared Cloudflare IP.
Who is affected
The Colab link led to a page called Windows Software Hub, which showed a version number, a download count, and Virus Free, Secure, and Verified badges.
Why it matters
It checks whether it is running in a virtual machine or sandbox, injects code into browser processes, replaces cryptocurrency addresses copied to the clipboard, and can download more malware.
Technical details
A download page and a file manager measure different things, so the size mismatch proves little by itself.