Attackers are abusing excitement around GTA VI leaks by distributing a fake 113GB “playable build” that is mostly empty data with a small malware payload hidden inside. The malware attempts to weaken defenses by adding Windows Defender exclusions and killing security tools, then likely prepares the system for follow-on attacks. Related lures include fake GTA 6 download sites, fake “GTA 6 Mobile” apps, and fake Rockstar Social Club login pages designed to steal credentials.
Attackers capitalized on excitement around a rumored GTA VI leak by promoting a supposed 113GB playable build. In reality, the file was 99.99% empty padding, essentially endless zeroes, wrapped around a tiny 50 KB payload. The large file size served as a disguise, making the download seem legitimate simply due to its scale, while the actual malicious code was small enough to hide easily inside the junk data.
Once executed, the payload contained commands designed to whitelist the entire C: drive in Windows Defender and forcibly kill security software using taskkill. This behavior suggests the malware was meant to weaken a system's defenses as a setup step, likely preparing the device for additional follow-on attacks rather than acting as a complete standalone threat.
The fake 113GB build was not an isolated case. Researchers also identified fake GTA 6 websites offering Windows installers that use DLL side-loading to execute malware, a fake GTA 6 Mobile app that redirects to a domain linked to infostealers and ransomware, and fake Rockstar Social Club login pages built to steal account credentials. Together, these lures show attackers targeting different entry points, downloads, mobile apps, and login pages, all tied to the same trending topic.
The timing mattered. Real leak activity around GTA VI was already circulating, which made the fake download feel plausible to users searching for the same content. When real and fake material appear side by side, it becomes harder for people to judge what is safe to download or trust. The combination of a hyped, unreleased game and an oversized file that looked
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers promoted a 113GB file claiming to be a playable GTA VI build, but it was 99.99% empty padding hiding a tiny 50 KB virus designed to weaken endpoint defenses.
Decompiled code contained commands to whitelist the entire C: drive in Windows Defender and kill security software using taskkill, effectively disabling antivirus before further attacks could launch.
Yes, related lures include fake GTA 6 websites offering Windows installers that use DLL side-loading, a fake GTA 6 Mobile app, and fake Rockstar Social Club login pages designed to steal credentials.
Real leak activity around GTA VI was happening at the same time, and mixing real and fake content made it harder for users to distinguish legitimate leaks from bait.
If you see a ‘leaked’ 113‑gig GTA VI download, assume it’s a trap, not an early access miracle. Researchers checked one of these files: it was 99.99% empty junk, endless zeroes, with a tiny 50 KB virus inside that tried to whitelist the entire C drive in Windows Defender and kill security tools. Same playbook with fake GTA 6 download sites, a bogus 'GTA 6 Mobile' app, even Rockstar Social Club lookalike logins, malware and credential theft wrapped in leak hype. Here’s the move: if you want GTA or any big-name game, only download and log in through official stores or rockstargames.com, never from torrents, ‘leak’ links, or random promo sites.
South Korean agencies warned that a state-backed hacking group is actively targeting citizens and businesses using job-themed phishing emails and “watering hole” attacks on legitimate websites. The phishing lures include fake job applicants sending resume links and impersonated recruiters sending…
Scammers quickly set up fake piracy pages for Christopher Nolan’s “The Odyssey” to trick people into either clicking a fake browser “Fix It Now” warning or downloading a “movie” that is actually a Windows program. The goal is to route victims through malicious advertising redirects or get them to…
The report describes confirmed phishing activity targeting the financial sector, where victims were tricked into fake login pages via emails, links, or HTML attachments. The credentials entered were then exfiltrated to attackers through Telegram using APIs. The same report also highlights ongoing…
Researchers found a criminal operation (StopAndProtect) that used nearly 2,000 hacked WordPress sites as a delivery network. Visitors were shown a fake CAPTCHA that pressured them to copy and run a PowerShell command, which then installed malware that could steal data, capture screenshots, and…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Researchers reported that scammers set up cloned piracy sites within hours of Christopher Nolan’s The Odyssey release to trick people looking for pirated copies. The scams used a fake “Browser Issue Detected” pop-up to push users into malicious ad redirects and a Windows .exe file disguised as a…
