GTA 6 Fans Keep Chasing Leaks, and Now Some of Those Leaks Are Emptying Their Wallets

Eleven weeks out from launch, GTA 6 fans have gotten very good at hunting for scraps. Every leak, every blurry screenshot, every "insider" Discord post gets torn apart within minutes. That instinct, built up over years of drought and then supercharged by the real Cyberleek leak in August, is now being turned against the exact people who have it. Security researchers have spent the past few weeks tracking a growing network of fake GTA 6 sites that don't just waste your time. They steal your passwords and, in at least one case, empty your crypto wallet.

The pattern started almost immediately after the real leak. On August 18, footage attributed to a leaker calling themselves Cyberleek hit social media, and Rockstar spent the following days scrambling to respond. Malwarebytes says the first malicious installer built to ride that same wave appeared just one day later, on August 19. By the time Malwarebytes published its analysis on August 24, it had found a whole network of copycat domains, including gta6demo.asia, gta6demo.eu, gta6demo.us, and rockstar-gta-6.com, all dressed up to look like official Rockstar promotion for a playable "Extended Look" demo.

Click "Play Now" on one of those sites and you don't get a demo. You get gta6_installer.exe, a roughly 1.1 MB file carrying a variant of the Vidar infostealer, sold on underground forums as malware-as-a-service. Once it runs, Vidar quietly launches Chrome, Edge, Firefox, and 16 other browsers in headless mode to reach their encrypted password stores, then pulls saved logins, session cookies, browsing history, and autofill data before phoning home to its command server. The detail that should worry people most is the session cookie theft. Because it hijacks an already-logged-in session, two-factor authentication doesn't necessarily stop it. The malware never has to guess a password if it can just steal the token that proves you already typed one in.

Then, on September 1, a second and arguably nastier variant showed up. Malwarebytes documented a site offering what it called a "leaked copy" of GTA 6 for PC, priced at $50 or 1 SOL (about $102 at the time). Instead of a download, visiting the page loads wallet-draining scripts. One targets Solana wallets directly. A second, heavier script reaches across seven blockchains, Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base, and Fantom, inventories whatever assets it finds, and either drains them immediately or requests approval permissions to do it later. The site even geoblocks visitors from Russia, Belarus, Kazakhstan, and several neighboring countries by IP, a common way scam operators try to dodge law enforcement in jurisdictions where they might actually face consequences. In a nice bit of irony, the page's own footer claims no purchases are being processed on it, right next to working payment buttons.

None of this is entirely new to gaming. Fake demos and phishing pages have trailed every major launch for years, and GTA 5's own build-up had its share of copycats. What's different here is the scale and the sophistication of the tooling arriving in lockstep with a single leak event, and the fact that crypto-draining scripts, effectively rented as a service by whoever set these sites up, are now a standard part of the kit. The scammers aren't improvising. They're running a business that scales to whatever hype cycle happens to be biggest that month, and this fall, nothing is bigger than GTA 6.

The uncomfortable part is how good the bait is getting. The crypto-drainer site reportedly listed the real November 19 release date accurately, which does more to build false trust than any fake logo could. Fans who've spent weeks parsing real leaks for authenticity cues, correct dates, plausible file sizes, familiar UI, are exactly the audience primed to apply those same instincts to a scam and conclude it checks out.

Rockstar has been vocal about the actual leak, calling it "heartbreaking" in its public statement in late August, but neither Rockstar nor Take-Two has issued a direct consumer warning about the malware sites specifically, leaving that job to independent security researchers and outlets covering it after the fact. That gap matters. There is no official GTA 6 demo. There has never been a downloadable GTA 6 demo. Any page offering one, or offering the full game early for cash or crypto, is lying by definition, and no amount of accurate release-date trivia on the page changes that.

With the shareholder meeting on September 18 unlikely to produce much new footage and the real marketing push still weeks away, the information vacuum that scammers thrive on isn't closing anytime soon. If anything, expect this cottage industry to get louder, not quieter, the closer November 19 gets.