Fake GTA 6 Download: This Malware Steals Wallets and Swaps Crypto Addresses
Grand Theft Auto VI comes out on 19 November, but only for PS5 and Xbox Series X|S. Rockstar has not announced a PC version yet. Scammers are exploiting exactly that gap: security firm Cynet has analysed a supposed GTA 6 download for Windows that installs malware instead of the game. It steals passwords, Steam logins and crypto wallet data. It also swaps wallet addresses that you copy.
What happened
The bait was a link reading "GTA 6 EXE file download" in a Google Colab notebook, so it sat on a trustworthy-looking Google address. It led to a page called "Windows Software Hub", complete with a version number, a download counter and badges such as "Virus Free", "Secure" and "Verified". The page promised a 72 MB file. The ZIP archive, however, held only a 796 KB program and a 1 KB text file.
That text file is the real trick. It tells users to run the program as administrator, click past the Windows security warning and, if needed, add an exception to their antivirus. Anyone who follows it opens the door for the attacker. The program contains no game files and nothing from Rockstar. According to Cynet, it is a loader for WARDEN Stealer.
What WARDEN Stealer does
WARDEN is malware written in Rust and rented out as "malware-as-a-service", so criminals can build their own variants. According to Gen Digital, the first versions appeared in May 2026, and it has been advertised since August. Besides fake games, it spreads through fake CAPTCHA pages ("ClickFix"), malicious ads, cracked software and cheat tools.
- Browser data: saved passwords and cookies, which let attackers take over logged-in sessions
- Wallets: data from browser extensions and desktop wallets
- Clipboard: when you copy a crypto address, the malware silently replaces it with the attacker's.
- Other accounts: Steam and Roblox accounts, password managers, messengers, 2FA apps and credentials for AI tools
- Downloads: the malware can install further malicious programs.
Not the first case
Scammers have been riding the GTA 6 hype for months. In August, Malwarebytes found fake "demo" sites spreading the Vidar data thief. In September came a site offering a supposedly leaked copy for $50 or 1 SOL. It emptied visitors' wallets as soon as they connected them. The closer launch day gets, the more such traps are likely to appear.
How to spot the trap
- There is no PC version. Any download of "GTA 6 for Windows" is currently a scam.
- Games come from official stores such as the PlayStation Store, the Xbox Store or, later, Steam and the Rockstar Launcher, not from Colab notebooks, forums or file hosts.
- Instructions that ask you to turn off your antivirus are always a red flag.
- Check every pasted address in full, not just the first and last characters. Clipboard malware relies on exactly that shortcut.
If you have already opened the file
- Disconnect the PC from the internet and treat every credential stored on it as stolen.
- Set up a new wallet with a new seed phrase on a clean device and move your funds there. New passwords alone do not help if your keys have leaked.
- From another device, change your passwords for exchanges, email and Steam, and log out of all active sessions.
- Reinstall the computer before using it for money matters again.
Why it matters
The attackers do not need a security flaw. They get the victim to switch off every protection themselves. As with the fake trastwallet.cam site and the scams after the Binance hack, the target is the person, not the technology. The same rule applies as with the iPhone flaw worse_query: a device on which you install games, cracks or unknown programs should hold small change at most. Larger amounts are safer on a hardware wallet, where the private keys never touch the PC.
Sources
