Fake GTA 6 Demo Installs Malware That Can Bypass MFA
Fake GTA 6 demo sites impersonating Rockstar install information stealing malware that can hijack browser sessions, even when MFA protects user accounts.
Summary
Cybercriminals are exploiting demand for Grand Theft Auto VI with fake websites impersonating developer Rockstar and promoting a playable demo that does not exist. Clicking “Play Now” downloads a file resembling a game installer, but Malwarebytes identified it as information stealing malware designed to extract browser passwords, cookies and logged in sessions. Stolen sessions can let attackers access accounts as the victim, sometimes despite MFA.
The campaign targets fans frustrated by multiple GTA 6 delays, more than a decade after GTA 5, which sold more copies than every game except Minecraft. GTA 6 is expected on November 19, 2026, while Netflix plans an extended look on Thursday that could clarify whether circulating leaks are legitimate. Until Rockstar releases an official download, players should avoid files from unverified sources.
Positives
- Malwarebytes identified the fake installer as information stealing malware, giving players a clear warning before downloading it.
- November 19, 2026 remains the expected release date for GTA 6 after multiple delays.
- Netflix will air an extended GTA 6 look on Thursday that could help assess the legitimacy of circulating leaks.
Risks & concerns
- Fake websites impersonating Rockstar advertise a playable GTA 6 demo even though no legitimate demo exists.
- The fake installer targets browser passwords, cookies and active logged in sessions.
- Stolen browser sessions can sometimes let attackers enter accounts despite MFA protection.
- More than a decade of anticipation and multiple GTA 6 delays give criminals a large pool of eager targets.