Scammers capitalize on GTA 6 hype to push malware and crypto cons

Scammers are offering supposed leaked builds, early copies and phone versions of Grand Theft Auto VI (GTA 6) weeks before the game’s November 19 launch, Netcraft warned in a new blog post.

The company looked at GTA VI-themed domains that appeared between July 1 and October 27, 2026. Most of the lures fell into four groups, with sites borrowing the name of popular GTA VI leaker CyberLeek, promising early access, advertising mobile versions that don’t exist, or giving the game away for free.

Some of these sites push malware or ask for money upfront. Others hide the promised download or code behind a content locker, which sends visitors through surveys and offers that appear to earn the site operator affiliate revenue.

Netcraft said it checked what each page showed and asked for, without paying, completing offers or connecting a crypto wallet, and cautioned that the sites can change quickly. A wallet prompt on a page, it noted, is “evidence of a risky lure but not proof that the site drains wallets.”

The leaker, an unidentified person or group, started publishing apparent GTA VI gameplay clips on August 18. What CyberLeek released was footage and images, with no game for anyone to download, but that hasn’t stopped others from using the name. Since the first clips surfaced, 121 newly registered domains have included “cyberleek,” 100 of them in August.

gta6cyberleek[.]com offered a free GTA VI download (Source: Netcraft)

At gta6cyberleek[.]com, a page made to look like Rockstar’s own offered a free download of a file called GTAVI.exe, which 34 of 68 security engines on VirusTotal flagged, mostly as a trojan. Another site, cyberleek[.]click, assured visitors its launcher carried “no malware or viruses,” then asked them to send $100 in cryptocurrency to unlock the game.

Fake leaked copies of the game have surfaced in the past. In September, Help Net Security reported on a supposed GTA 6 download, found by Huntress, that installed several remote access trojans, an infostealer and a Chaos ransomware variant used to destroy victims’ files.

Paying for access that doesn’t exist

Rockstar has announced GTA VI only for PlayStation 5 and Xbox Series X|S, with no PC version and no early release. Even so, gta6[.]exposed offered the game for any platform, PC included, for $199 in crypto, and other sites posed as Rockstar stores taking preorders.

“These sites do not need to deliver convincing software to make money. A polished preorder page and a familiar payment flow may be enough to persuade a user to pay for a version or access arrangement that the official release does not offer,” Netcraft noted .

A similar pitch showed up in June, when Malwarebytes spotted sites selling GTA 6 early access for cryptocurrency, one of them for $250.

Mobile versions and free keys that never arrive

Mobile versions are another popular bait, even though Rockstar has not announced the game for Android or iOS. Some sites hand out Android package (APK) files and tell users to allow installation from unknown sources, while others put the download behind a “Human Verification” popup that asks for an email address and other personal details.

Giveaway pages work the same way. Sites such as mygta6[.]icu show fake feeds of players claiming keys and counters of codes running out, reveal part of a key, and then demand that the visitor complete offers to get the rest.

Once the game is out, Netcraft expects the pitch to change from getting the game to getting ahead in it. Fake offers of free GTA$, the in-game currency, will probably grow, and some could ask for Rockstar, PlayStation or Xbox logins under the pretext of applying a bonus.

Reused passwords could then open other accounts, and an account with a saved payment method could be used for unauthorized purchases.

Until November 19, there is no legitimate playable release or early-access build of GTA VI, and the safest place to buy it is the official PlayStation or Xbox store.