Fake GTA 6 “Demo” Sites Push Password-Stealer

Attackers are using convincing Rockstar Games lookalike websites to trick people into downloading a supposed “GTA 6 demo.” The download is actually Vidar infostealer malware that can steal browser passwords, cookies, and logged-in sessions, potentially exposing personal and work accounts if they were used in the same browser.

Key findings

• There is no legitimate GTA 6 demo; lookalike Rockstar sites are offering a fake download.
• The fake sites use a “Play Now” button to download a small executable named `gta6_installer.exe`, which was identified as Vidar infostealer.
• The malware targets browser-stored data including saved passwords, session cookies, autofill data, and browsing history, potentially exposing work, banking, and shopping accounts.
• Stolen session cookies can allow account access without re-entering credentials or completing MFA again, making session theft especially risky.
• Recommended response includes scanning the device, changing passwords from a clean device, and signing out active sessions; notify IT/security if work accounts were involved.

Who’s being targeted

• Commonly targeted roles: All employees, Helpdesk/IT support, Security team, Employees with access to sensitive web-based apps (email, finance, HR, admin consoles).
• Affected industries: Gaming/Entertainment, Any organization where employees use browsers for work accounts (cross-industry).
• Attack channels: website.
• Impersonated: Rockstar Games (lookalike website).

Awareness takeaways

• Treat “too good to be true” downloads tied to major releases as high risk; verify offers using official channels before clicking.
• Avoid downloading software from unofficial sites or search ads; use recognized stores and official vendor pages only.
• Session cookies can bypass normal logins; if malware runs, assume accounts may be compromised even if MFA is enabled.
• If a personal-looking scam may have touched work accounts, escalate to IT/security and follow incident steps (scan, reset from a clean device, revoke sessions).

Red flags to watch for

• There is no official GTA 6 demo (offer itself is the warning sign).
• Download is offered outside Rockstar or a recognized game store.
• Installer is suspiciously small for a modern game (1.1 MB).