Fake GTA 6 Download Sites Are Emptying Saved Passwords
The hype around Grand Theft Auto 6 has turned into a password-stealing trap. Days after a GTA 6 leak began spreading on 18 August, scammers stood up fake "GTA 6 demo" and download sites, and the Play Now button hands you an infostealer instead of a game. Security firm Malwarebytes traced the campaign to lookalike domains such as gta6demo[.]asia, gta6demo[.]eu, gta6demo[.]us and rockstar-gta-6[.]com. Click download and you get gta6_installer.exe, a file of just 1.1 MB, impossibly small for a real game and a dead giveaway that something is wrong.
How the trap works
The installer is Vidar, an infostealer sold as a service to criminals. It does not need to crack your browser's encryption. Instead it quietly launches your own Chrome, Edge, Firefox, Brave, Opera or Vivaldi in headless mode, so the browser itself unlocks its saved data and hands it over. The first sample was spotted on 19 August, one day after the leak, riding the wave of people searching for an early look at the game.
What Vidar steals
Once it runs, it sweeps up far more than a game key would need:
- Saved passwords and logins from up to 19 browsers.
- Session cookies, which let an attacker step into your accounts without the password and even past two-factor login.
- Browsing and download history and autofill data, including addresses and card hints.
- Email and other apps. It also targets the Thunderbird mail client, Perplexity's Comet browser and credentials saved by FTP clients.
- Crypto and gaming accounts. Wallet data and tokens for services like Steam and Discord are prime targets.
To stay hidden, Vidar does not hard-code its control servers. It reads them from ordinary-looking profiles on Telegram, Pinterest and Steam, so the traffic blends in with normal services.
How to protect yourself
- There is no public GTA 6 demo. Any site offering a "demo" or early download is fake. The game comes only from Rockstar and official stores.
- Check the file size. A modern AAA game is tens of gigabytes. A 1 MB "installer" is malware, not a game.
- Do not trust search ads or mirrors. Malicious pages buy their way to the top and copy Rockstar's artwork, sometimes generated with AI.
- If you already ran it, act fast. From a different, clean device, change your important passwords, then sign out of active sessions everywhere and turn on two-factor authentication.
- Watch your accounts. Check email, crypto and gaming accounts for new logins, changed recovery details or unfamiliar devices.
