A scam is using hype around Grand Theft Auto 6 to trick people into downloading a “leaked, playable build” from torrent sites. The file is mostly junk data, but it contains a small malware payload that tries to weaken Windows Defender and stop security tools, giving attackers control of the infected machine. Other nuggets in the roundup cover exposed AWS keys and multiple non-social-engineering threats (backdoor malware, a Zimbra RCE, and a power disruption).
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
See a torrent called “GTA 6 Pre-Release Build (Playable), 113GB, leaked build”? That’s not early access, that’s a trap. That 113GB file? Almost all junk padding wrapped around a tiny malware payload that tries to whitelist your entire system drive in Windows Defender and kill your security tools. Scammers are riding real GTA 6 hype and leaked gameplay footage to make this look legit. The giveaway: a too-good-to-be-true leaked build that needs admin rights and immediately messes with Defender settings. If you ever see a “leaked” game or pirated software on a work device, especially one that touches Defender settings, don’t run it. Close it and report it to IT immediately.
CERT-UA reported a real phishing campaign where victims receive an email with an image attachment that leads (via a shortened link) to a ZIP download. The ZIP contains a script disguised as a PDF, which installs a malicious Notepad++ plugin and sets up an automated task that repeatedly runs malware…
Researchers found 16 look‑alike (typosquatted) RubyGems packages that trick developers into installing a Windows information stealer. The malicious gems run code automatically during installation, pull down additional malware, and then steal browser logins and crypto wallet data before uploading it…
Researchers describe an active campaign ("SMOKE#SCREEN") where attackers trick users with realistic software update and document-themed lures to install a legitimate remote-control tool (ScreenConnect). Once installed, the attacker gains persistent remote access that can look like normal IT…
Attackers used fake Steam forum replies that looked like helpful troubleshooting steps for real gaming/PC problems. The posts tricked users into running PowerShell as an administrator, which then downloaded and installed the XMRig crypto miner and set it to run automatically at startup. The…
Cisco Talos reports a real, ongoing campaign where a Russian-speaking criminal group tricks people into installing trojanized versions of popular software (like Webex, Zoom, and MobaXterm). Once a victim runs the fake installer, a custom remote-access tool (“Starland RAT”) is installed and used to…
A large review of “AI-enabled malware” found most samples were proof-of-concepts, but a small set were real threats seen in production environments. The real-world activity included trojanized installers that pretended to be legitimate apps (like a recipe app or a Dropbox installer) and relied on…
