GTA VI Scam Sites Sell Fake Leaks, Paid Keys and Malware Ahead of the 19 November Launch

Two weeks before Grand Theft Auto VI goes on sale, sites trading on the game's name are selling copies that don't exist and serving downloads that antivirus engines flag as malware. Netcraft, which reviewed GTA VI-themed domains first seen between July and late October, found 121 newly registered domains containing "cyberleek", 100 of them registered in August, though it says not every one is fraudulent. Rockstar lists the game as coming 19 November 2026 for PlayStation 5 and Xbox Series X|S, and Netcraft notes that the studio "has not announced a PC or mobile version". Any PC or phone download is therefore fake.

What the fake sites offer

The name borrows from CyberLeek, a leaker who began posting apparent footage on 18 August. A file called GTAVI.exe on one such site was detected by 34 of 68 security engines on VirusTotal, mostly as a trojan. Another site's launcher, flagged by 18 of 62, then asked for $100 in cryptocurrency to "activate an account". A third sold a key for $199 that supposedly worked on PC.

Phone owners are offered Android packages to sideload. Three of the APK sites Netcraft lists use Indian domains: gta6[.]io[.]in, gta6apks[.]in and gta6mobile[.]com[.]in. Other sites on the list hide giveaways of GTA$250,000 to GTA$10 million behind "verification" steps.

Infostealers and a wiper

In August, Malwarebytes traced fake demo sites serving a 1.1 MB gta6_installer.exe that turned out to be the Vidar infostealer, which takes saved passwords and session cookies from 19 browsers. Huntress found a fake "leaked" ISO that installs NjRAT, DCRAT, the Mercurial Grabber stealer and a Chaos ransomware variant used as a wiper. ThaiCERT warned in August that "there is currently no GTA VI build legally available for public download or play".

Netcraft expects the bait to shift after launch to free GTA$, Shark Cards, money glitches, cheats and mods, and to phishing for Rockstar, Microsoft and Sony logins.

What researchers tell players to do

Netcraft says to buy only through legitimate retailers like the official PlayStation and Xbox stores, and to distrust any site that wants crypto to activate a game. Digit puts the Indian price of the standard edition on those stores at Rs 5,999. Anyone who ran one of these files should, Malwarebytes says, scan the machine and change passwords from a clean device, starting with email, then sign out of all sessions and turn on two-factor authentication.