GTA VI isn’t out yet – and the scams are already in full swing

On November 19^th, 2026, Grand Theft Auto VI will be released for PlayStation 5 and Xbox Series X|S. But cybercriminals aren’t waiting for launch day. They have long been capitalizing on the hype around what’s arguably the most anticipated game of the decade, using fake leaks, malware-laced downloads, bogus online stores with rock-bottom prices, and fraudulent “early access” schemes to lure eager fans. Security experts at ESET expect such scams to proliferate as the release approaches and the holiday shopping season gets underway.

Key points of this blogpost:

• GTA VI launches on November 19^th, 2026, for PlayStation 5 and Xbox Series X|S. Rockstar hasn’t announced a PC version, playable demo, beta, or early-access program.
• Fake GTA VI downloads can pose a serious security risk. Researchers found installers and “leaked” builds that carry infostealers, remote-access trojans, and destructive malware.
• A convincing storefront doesn’t guarantee a legitimate offer. Be wary of unusually low prices, cryptocurrency-only payments, and offers of a PC version or early access that contradict Rockstar’s official information.
• The risks are likely to shift around launch and the holiday shopping season, with pre-load scams, fake gift cards and bundles, and eventually bogus cheats, mods, and “PC version” downloads providing new lures.

What’s real: the official facts

It’s easy to see why the franchise makes such an attractive lure: Grand Theft Auto is one of the most successful entertainment properties of all time, with more than 470 million units sold worldwide, according to Rockstar Games. Before taking a closer look at the scams tied to GTA VI, let’s establish what Rockstar has actually announced.

Pre-orders opened on June 25^th. According to Rockstar Games’ official pre-order announcement, the Standard Edition is priced at $79.99 in the United States, while the Ultimate Edition costs $99.99. Players who pre-order a digital copy have been able to pre-load the game since November 10^th.

What Rockstar has not announced is just as important, particularly with so many fraudulent offers circulating online: there is currently no official beta, playable demo, or early-access program that would let players start playing GTA VI before release day.

Nor has Rockstar announced a PC version, PC release date, or system requirements. This makes the official information a useful reality check: offers built around a supposed PC version, beta, demo, or early access are promising something Rockstar has never confirmed.

Table 1. GTA VI scams at a glance

Leaks fuel the hype

The enormous anticipation for GTA VI has also made every new leak a magnet for attention. On August 18^th, an entity calling itself CyberLeek began releasing what it claimed was stolen GTA VI material, starting with two gameplay videos and an alleged map of Leonida. By October 12^th, TechWiser had cataloged 19 CyberLeek leaks. The material reportedly included in-game activities, clips featuring cars and aircraft, glimpses of locations and NPC behavior, and eventually story content showing part of Lucia’s prologue. Rockstar has publicly responded to the leaks, describing the release of unfinished material as “heartbreaking” and taking legal action in response.

But CyberLeek wasn't only chasing attention. The campaign also became intertwined with a cryptocurrency called $CYBERLEEK, launched on the Solana blockchain. CyberLeek introduced a token-based voting system in which holders could use $CYBERLEEK to vote on what material would leak next. BitOK, a blockchain analytics company, later investigated the associated on-chain activity and identified several channels through which money flowed into the operation, including token swap fees, voting payments, and direct payments on CyberLeek-linked websites. In one transaction sequence on August 27^th, the wallet that created the token claimed and sold liquidity-pool fees totaling 2,676.67 SOL (approximately $225,000 as of November 11^th, 2026). That said, BitOK cautions against equating individual blockchain flows with net profit or attributing all funds moving through these wallets to a particular person once they have mixed with money from other sources.

The CyberLeek name quickly spread beyond the original leak campaign. Netcraft identified 121 newly registered domains containing “cyberleek” after the first clips appeared, including 100 registered in August alone. Not all of them were malicious: some belonged to fan sites, merchandise, or memecoin-related pages. Others used the name to push fake GTA VI builds (more on this below).

For cybercriminals, however, the significance of a high-profile leak extends beyond the footage itself. Once apparently genuine gameplay is circulating online, the prospect of obtaining the full game can start to seem considerably more plausible. That creates fertile ground for fake downloads and fraudulent offers claiming to provide an elusive “full build.” In fact, BitOK found that CyberLeek-linked websites later advertised a purported “GTA VI: Development Build” for $40, but its blockchain analysis couldn’t establish that anyone who paid actually received genuine GTA VI files. This gap between what appears to have actually leaked and what eager fans hope might be available creates exactly the kind of uncertainty that scammers can exploit.

What’s really inside a “free GTA VI” download

While alleged GTA VI footage has circulated online, security researchers have found no evidence of a genuine playable leaked copy being distributed. What they have found are malware campaigns designed to cash in on the demand for one. Some mimic Rockstar’s official marketing, while others pose as full-size game files.

In August, Malwarebytes discovered websites impersonating Rockstar Games that appeared in searches for a GTA VI demo. The sites copied Rockstar’s promotion for its August 27^th Extended Look, a gameplay presentation that premiered on Netflix, but added a fake “Play Now” button leading to gta6_installer.exe. There was no game inside. At just 1.1 MB, the executable contained Vidar, an infostealer that targeted saved passwords, and autofill information across 19 browsers, including Chrome, Edge, Firefox, Brave, Opera, and Vivaldi, as well as FTP credentials.

Vidar’s operators have used tech hype as bait before. The ESET Threat Report H1 2024 previously documented a campaign in which a fake Midjourney desktop installer delivered Vidar. ESET noted that the infostealer could log keystrokes and steal browser credentials and crypto wallet data. More broadly, infostealers are designed to quietly harvest sensitive information from browsers, applications, email clients, and crypto wallets. Stolen session cookies are particularly valuable because, depending on the service and its security controls, they can sometimes allow attackers to reuse an authenticated session without entering the victim’s password or multifactor authentication code again.

A separate campaign analyzed by Huntress took the opposite approach. Instead of a suspiciously tiny installer, threat actors distributed GTA VI-themed ISO disk images exceeding 100 GB, padding them with junk data to imitate the expected size of a modern AAA game. The files were promoted through manipulated search results (SEO poisoning), gaming forums, social media, and torrent sites.

One ISO contained a fake installer and several different threats instead of GTA VI: the njRAT and DCRat remote-access trojans, the Mercurial Grabber infostealer, and Chaos ransomware. Our analysis of DCRat (in Spanish) describes it as a widely distributed AsyncRAT variant capable of taking screenshots, logging keystrokes, managing files and processes, executing commands remotely, accessing stored credentials, and downloading additional plugins. The RATs could give attackers substantial control over an infected PC, while Mercurial Grabber went after Discord tokens, Chrome passwords and cookies, and gaming-related session data. Chaos was even more destructive, encrypting files up to 200 MB and overwriting larger ones with random data. Huntress found no apparent way for victims to pay to recover their files, effectively making the malware a wiper rather than conventional ransomware.

The fake GTA VI installer also had a clever explanation ready for why the “game” wouldn't run. Users were warned in advance that the supposedly leaked, unlicensed copy might produce a “License not found” error. Once the malware was installed, exactly that message appeared, giving victims a plausible reason for the missing game while the malicious components were already running in the background.

Fake builds have kept appearing as launch approaches. In November, Netcraft reported finding CyberLeek-themed sites offering what they claimed were complete GTA VI builds. One provided a file called GTAVI.exe, which was flagged by 34 of 68 security engines on VirusTotal, primarily as a trojan. Another offered a dedicated “Cyberleek Launcher” for the “full leaked version” before asking users to pay $100 in cryptocurrency to unlock the game. ESET has detected dozens of malicious files masquerading as GTA VI-related content.

Table 2. Some of the malicious GTA VI-themed filenames seen by ESET

Fake stores and the promise of “early access”

Not every GTA VI scam needs to hide malware inside a download. In some cases, the product itself simply doesn’t exist. Fraudulent websites can mimic legitimate online stores or present themselves as exclusive gaming marketplaces, offering something that Rockstar has never actually put on sale: early or beta access, or some other way to play GTA VI before everyone else. ESET telemetry shows just how broad the web infrastructure has become, with thousands of domains registered using GTA VI-related terms or impersonating Rockstar Games. Not all of them are malicious, or even active: some are legitimate fan pages collecting information about the upcoming launch, while others don’t currently serve any content.

The basic premise can be surprisingly convincing because early-access programs, beta tests, founder's packs, and special editions are common elsewhere in gaming. Scammers play on this familiarity to make nonexistent GTA VI offers seem plausible, coupling them with polished artwork, official-looking branding, and language suggesting exclusivity or urgency. Fake pages are typically decorated with GTA VI logos, neon Vice City-style imagery, luxury cars, and AI-generated pictures while promising “VIP Digital Access” or an “Exclusive Early Access Preview.”

Another variation exploits demand for unannounced platforms. Netcraft found websites advertising “GTA 6 APK,” “GTA 6 Mobile,” and Android beta versions, even though Rockstar hasn’t confirmed the game for Android or iOS. Some sites offered APK files, while others used the promise of a mobile version to funnel visitors through “human verification” pages requiring surveys, app installations, or personal information.

One site distributed an Android “beta” called GTA.VI.8.0.9.Beta and instructed users to allow installation from an unknown source. Interestingly, no security engine detected the APK as malicious when Netcraft checked it with VirusTotal. But that doesn’t make it a legitimate copy of GTA VI: no official mobile version exists, and a clean malware scan doesn’t establish that an unvetted file is what it claims to be.

One scam documented by Malwarebytes shows how elaborate the deception can become. The site advertised exclusive early access for $250, accepting payments only in Bitcoin, USDT, or Ethereum. After sending the cryptocurrency, buyers were instructed to wait for payment confirmation and enter their transaction ID to “unlock” their download. The webpage included QR codes, payment-verification messages, and a prominent download button, creating what looked like a working checkout. Only one thing was missing: the game.

Paying in crypto adds another complication. Unlike card payments, cryptocurrency transfers offer no chargeback mechanism. As we noted recently, this is one reason scammers favor them: once the funds reach a fraudster-controlled wallet, they are extremely hard to recover.

From pre-load to Black Friday

The days leading up to launch could give scammers yet another opening. Digital pre-loading began on November 10^th, nine days before GTA VI becomes playable on November 19^th. Rockstar says the pre-load can require up to 212 GB, depending on the device, while code-in-box versions are expected to reach retailers from November 12^th. But pre-loading doesn’t mean playing early: the game remains locked until its official release.

That distinction gives scammers a particularly believable pretext. As millions of players wait for their copies to unlock, fraudulent messages could claim that a pre-load has failed, a pre-order has been canceled, or some additional action is required to activate the game. Links in such messages may lead to phishing pages designed to steal their PlayStation, Xbox, Rockstar, email, or payment details.

The safest response to an unexpected message about a pre-order or pre-load is therefore not to follow the link it provides. Instead, gamers can open the relevant console store or account directly and check the status of their purchase there. Similar caution should apply to messages asking users to “verify” their account, payment information, or purchase to prevent an alleged cancellation.

GTA VI’s launch arrives just as the holiday shopping season moves into full swing, with Black Friday falling on November 27^th, 2026. That combination could give scammers another powerful lure: not just the game itself, but supposed holiday bargains built around it. Shoppers should be wary of unfamiliar stores advertising deeply discounted GTA VI copies, gift cards, or tempting console-and-game bundles. The holiday angle could also broaden the pool of potential victims beyond dedicated GTA fans. Parents, relatives, and other gift buyers may be less familiar with exactly which GTA VI products and platforms Rockstar has officially announced, making offers for a nonexistent PC version, an unusually cheap bundle, or a bogus special edition harder for them to assess. After launch, the lures are likely to shift again toward fake cheats, mod menus, in-game currency generators, and “PC version” downloads.

Seven ways to avoid GTA VI scams

The excitement surrounding a major game launch can make an unexpected discount, a “leaked” build, or an exclusive offer difficult to resist. But many of the scams discussed above can be spotted by slowing down and comparing the offer with what Rockstar has actually confirmed. Here are seven precautions worth taking.

1. Stick to official sources
Buy GTA VI through the PlayStation Store, Microsoft Store, Rockstar Games Store, or established retailers. Be particularly careful with links in advertisements, social media posts, emails, search results, or messages promising a special deal. Instead of following the link, navigate to the retailer or platform directly.

2. Be suspicious of prices that look too good to be true
Compare an offer with the game's official price before buying. A dramatic discount from an unfamiliar retailer, especially for a highly anticipated title around launch, merits extra scrutiny. Don't let a countdown timer, “only two copies left,” or similar pressure rush you into paying before checking the seller. Digital copies do not sell out.

3. Investigate the store, not just the product
Before buying from an unfamiliar shop, look for verifiable contact information, company details, terms and conditions, and a clear return policy. Search independently for information about the retailer rather than relying entirely on glowing reviews displayed on its own website. Also remember that professional graphics, GTA VI artwork, trailers, and trust badges do not prove that a shop is legitimate.

4. Choose a payment method with protection
Think twice when an unfamiliar seller insists on cryptocurrency, gift cards, or other payment mechanisms that offer limited recourse if something goes wrong. Use a credit card or another payment method with buyer protection.

5. Compare extraordinary promises with the official facts
A scam can sometimes be identified simply by looking at what is being offered. As covered above, Rockstar has announced GTA VI only for PlayStation 5 and Xbox Series X|S, with no beta, demo, or early access. Any offer for a PC or mobile version, or of an early start, is a red flag.

6. Let security tools provide another line of defense
Keep your operating system, browser, and security software up to date, and do not ignore warnings about suspicious websites or downloads. ESET also provides an ESET Link Checker that can be used to check suspicious links before opening them.

7. If something goes wrong, act quickly
If you made a purchase from a dubious online store, ran a file you now doubt, or noticed strange activity on one of your accounts, don’t wait. Contact your bank or card issuer if you shared payment details, and keep screenshots and receipts as evidence. Change your passwords from a clean device and sign out of all active sessions, since stolen session cookies can outlast a password change. Then scan the device with security software.