Fake GTA 6 Demo Sites Push Password-Stealing Malware

Malwarebytes · Medium sophistication
Last updated August 25, 2026

The article describes real-world scams riding on the GTA 6 leak hype, including fake “Extended Look” and “demo” websites that deliver password-stealing malware. It also warns about “free early access” offers designed to drain crypto wallets, showing how leaked footage can make these lures more believable.

Key findings

  • Malwarebytes reports fake “GTA 6 Extended Look” and “demo” sites that deliver an infostealer (password-stealing malware).
  • Scammers are using “free early access” promises to trick people into handing over crypto wallet value.
  • Real leaked footage can make scam pages feel more credible to victims.
  • A separate (non-social-engineering) section describes ShinyHunters stealing Rockstar records by targeting a third party (Anodot) holding persistent authentication tokens.

Who’s being targeted

  • Commonly targeted roles: All employees, Security awareness training audience, Employees who use Discord/online communities, Employees who use cryptocurrency wallets.
  • Affected industries: Gaming, Consumer/Entertainment, Information/Media.
  • Attack channels: website.
  • Impersonated: Rockstar / GTA 6 (implied by the fake demo/look branding), GTA 6 / Rockstar (implied by the early access offer).

Awareness takeaways

  • Do not trust ‘early access’ promises or unofficial demos, use only official purchase/download channels.
  • Treat hype events (leaks, viral clips) as a risk signal, attackers use them to make scams feel authentic.
  • If a page or download claims to be a ‘demo’/‘extended look,’ assume it could be password-stealing malware unless validated.

Red flags to watch for

  • Unsolicited or hype-driven “demo” download for a game that is not officially released
  • Non-official download source (not the official Rockstar store)
  • Pressure/FOMO created by “leaked footage” buzz
  • “Free early access” claims for a highly anticipated title
  • Anything requesting wallet connection or crypto-related steps to ‘unlock’ access
  • Not using official purchase channels
Try Mirage

Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.

Get a demo
Read the video transcript

You see a link: “GTA 6 Extended Look – playable demo, leaked today.” Tempting, right? Malwarebytes actually found fake GTA 6 “Extended Look” and “demo” sites that install password-stealing malware. Real leaked footage is embedded to make the page feel legit. Another twist: “Free early access to GTA 6, connect your crypto wallet to unlock.” That’s not a bonus, that’s a drain-your-wallet scam. If you see a GTA 6 “demo,” “extended look,” or “free early access” outside official Rockstar channels, assume it’s malware or a wallet scam, close the tab and walk away.

Similar attacks

Fake GTA 6 Demo Sites Push Password Stealer

Fake GTA 6 Demo Sites Push Password Stealer

Attackers are exploiting GTA 6 hype by creating convincing fake Rockstar-branded “demo” websites that appear in Google search results. The sites use “Play Now”/“Official Download” lures to trick people into downloading a small Windows executable that installs Vidar infostealer and steals saved…

August 24, 2026
Fake Claude Max Promo Steals Google Logins

Fake Claude Max Promo Steals Google Logins

Researchers found a real phishing campaign offering a “free” Claude Max upgrade to trick people into signing in with Google. The site uses a fake, draggable Google login pop-up (“browser-in-the-browser”) that looks legitimate and captures credentials. A stolen Google account can expose email and…

September 23, 2026
Fake Claude Max Promo Steals Google Logins

Fake Claude Max Promo Steals Google Logins

Researchers found a phishing campaign offering a “free” upgrade to Claude Max to trick people into signing in with Google. The page uses a convincing fake, draggable Google login window (“browser-in-the-browser”) to capture credentials, potentially giving criminals access to email, documents, and…

September 23, 2026
ClickFix Lures Spread ChainScript RAT

ClickFix Lures Spread ChainScript RAT

Researchers describe real-world “ClickFix” social-engineering lures that trick people into installing malware by downloading fake apps (like Spotify/Zoom/Teams) or copying commands into Terminal. One campaign abused a compromised, verified HBO Max Reddit account to run malicious ads, while another…

September 21, 2026
Fake GTA 6 “Demo” Sites Push Password-Stealer

Fake GTA 6 “Demo” Sites Push Password-Stealer

Attackers are using convincing Rockstar Games lookalike websites to trick people into downloading a supposed “GTA 6 demo.” The download is actually Vidar infostealer malware that can steal browser passwords, cookies, and logged-in sessions, potentially exposing personal and work accounts if they…

August 27, 2026
Fake GTA 6 “Leaked Copy” Site Drains Wallets

Fake GTA 6 “Leaked Copy” Site Drains Wallets

A scam website posing as a GTA 6 fan countdown page tricks visitors into buying a “leaked copy” and then prompts them to connect a crypto wallet. Once connected, it generates transactions/approvals designed to transfer the victim’s cryptocurrency (and potentially NFTs) to the attacker. The site…

September 1, 2026