Be careful of the alleged GTA 6 demo for the PC: It is “just” malware

Fans are hoping for an early look at GTA 6 through dubious pre-release versions. Instead of the blockbuster, however, the Vidar info stealer ends up on the hard drive. This collects sensitive browser data in the background and empties crypto wallets.

Fake GTA 6 demo steals data

Cybercriminals are currently spreading an alleged demo version of the not-yet-released but leaked playable version of GTA 6 via genuine-looking websites. However, instead of the expected title, users simply download the file gta6installer.exe onto their computers. The program is the well-known Vidar Infostealer. The attackers are specifically exploiting the anticipation of the game announced for November 2026 and the headlines surrounding the latest video leaks.

The malware targets passwords, cookies and session data from 19 different browsers. These include programs such as Google Chrome, Mozilla Firefox and Microsoft Edge. The criminals’ goal is to gain extensive access to email accounts, networks or gaming profiles. The perpetrators also specifically search for digital crypto wallets on the system.

Browser protection features bypassed

Security researchers from Malwarebytes explain in detail how the attack takes place. The malware launches legitimate browsers in the background to bypass local encryption. The malicious software accesses temporary data directories, reads unencrypted information and then deletes its traces. The approach poses an immense risk for the end users affected. If attackers steal valid session tokens, they can log in to third-party services without two-factor authentication in place.

The pest also does not permanently embed itself in the Windows operating system. Since no visible windows appear, an infection usually goes unnoticed. Because hackers take over active logins, simply changing your password after an attack is often no longer sufficient.

Danger from unofficial downloads

The scammers are copying official Rockstar Games promotional materials for their illegal campaign. They are skillfully taking advantage of the attention surrounding a video presentation on Netflix announced for the end of August as well as recently emerged leaks. But of course there is no official, playable pre-release version, especially not for the PC. In principle, such offers are always counterfeits. A technical detail immediately exposes the current fraud, at least if you look a little closer. The downloaded file is just over a megabyte in size.

However, a modern video game requires many times more storage space, often over 100 gigabytes. Anyone who has still executed the file should immediately revoke all active browser sessions. In addition, those affected must deregister unknown devices and comprehensively renew all access data.