VULNpocalypse
MediumEcosystem changeActive

Fake GTA VI download sites push malware and crypto scams ahead of the November 19 launch

Netcraft found fake GTA VI leaked builds, early access and mobile downloads that deliver flagged malware or demand crypto before the November 19 launch.

Published
Updated
Exploitation
Yes, Netcraft found live fake sites serving files flagged as trojans and demanding crypto payments, though detections are not confirmed infections

What happened

Netcraft research on GTA VI-themed scam sites was reported by Hackread and Help Net Security. Scammers are offering supposed leaked builds, early copies and mobile versions of Grand Theft Auto VI ahead of its November 19 launch. According to Help Net Security, Netcraft looked at GTA VI-themed domains that appeared between July 1 and October 27, 2026.

Key findings:

  • CyberLeek name abuse. CyberLeek is an unidentified person or group that began publishing apparent GTA VI gameplay clips on August 18. Per Help Net Security, CyberLeek released only footage and images, with no game to download. Netcraft found 121 newly registered domains containing “cyberleek”, 100 of them in August, and noted that not all were fraudulent (Hackread).
  • Flagged malware. At gta6cyberleek.com, a file named GTAVI.exe was flagged as a Trojan by 34 of 68 security vendors. Another site, cyberleek.click, offered a launcher flagged by 18 of 62 engines and then demanded $100 in cryptocurrency to unlock access. Hackread notes these detection figures indicate suspicious files, not confirmed infections.
  • Fake platforms. Rockstar has announced GTA VI only for PlayStation 5 and Xbox Series X|S, with no PC or mobile version announced. Even so, Help Net Security reports that gta6.exposed offered the game for any platform, PC included, for $199 in crypto, and other sites posed as Rockstar stores taking preorders. Hackread reports other pages offered APK files or claimed to provide Android and iOS versions.
  • Content lockers. Some sites never deliver a download. They send visitors through surveys, app installs or personal data requests before supposedly revealing a game key, as seen on mygta6.icu and gta6keycodes.com. Help Net Security describes this as appearing to earn affiliate revenue for the site operator.
  • Android sideloading. Some sites hand out APK files and tell users to allow installation from unknown sources, while others use a “Human Verification” popup that asks for an email address and other personal details (Help Net Security).

Netcraft cautioned that a wallet prompt on a page is “evidence of a risky lure but not proof that the site drains wallets”, and that these sites can change quickly. It also warned that “A clean scan at one point in time also does not turn an unvetted, falsely described APK into a legitimate game.”

Related earlier activity cited by the outlets: Help Net Security says that in September Huntress found a supposed GTA 6 download that installed several remote access trojans, an infostealer and a Chaos ransomware variant. Malwarebytes spotted sites selling GTA 6 early access for crypto in June, one for $250. Hackread also reports fake GTA VI beta downloads promoted through Facebook ads in 2024.

Netcraft expects the scams to shift after launch toward cheats, money glitches, fake support pages and free GTA$ offers. Some could ask for Rockstar, PlayStation or Xbox logins under the pretext of applying a bonus.

No CVEs, vendor patches or fixed versions are involved. Rockstar Games’ own systems are not reported as compromised.

Am I affected?

You are at risk if you:

  • Downloaded or ran GTAVI.exe, a “Cyberleek Launcher” or any other “leaked”, “early access”, PC or mobile GTA VI file from an unofficial site.
  • Installed an APK after enabling installation from unknown sources, in order to get a GTA VI mobile version.
  • Paid cryptocurrency, such as $100, $199 or $250 amounts mentioned in the reports, for GTA VI access or a PC or console key.
  • Entered email, personal details or Rockstar, PlayStation or Xbox credentials on a giveaway, key or “human verification” page.
  • Completed surveys or installed apps from a site promising a free GTA VI key.

Whether any specific download infected a given machine is not confirmed. The reported detection ratios are scanner flags only. Any GTA VI PC or mobile offer is not legitimate based on what Rockstar has announced.

What to do now

  1. Do not download, run or pay for any GTA VI build, launcher, key or early-access offer. Until November 19 there is no legitimate playable release or early-access build.
  2. Buy only from the official PlayStation or Xbox store.
  3. If you ran GTAVI.exe or a similar launcher, disconnect the machine from the network, run a full scan with a reputable endpoint product, and consider reinstalling the OS. Reported related lures in September included remote access trojans, an infostealer and ransomware.
  4. If you installed an APK, remove it, turn off installation from unknown sources, and scan the device.
  5. If you entered passwords on any of these pages, change them now, enable multi-factor authentication, and change any reused passwords elsewhere. Check accounts with saved payment methods for unauthorized purchases.
  6. If you sent cryptocurrency, contact your exchange or wallet provider and report the fraud. Recovery is not confirmed to be possible.
  7. Treat future offers for cheats, money glitches, free GTA$ and fake Rockstar support pages with the same suspicion after launch.
  8. Security teams: consider blocking or monitoring the domains named above (gta6cyberleek.com, cyberleek.click, cyberleek.my, gta6.exposed, mygta6.icu, gta6keycodes.com) and warning staff and users about game-themed lures. A clean scan does not make an unvetted download safe.

Sources