Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware
Huntress tracked fake GTA 6 downloads distributing NJRAT, DCRAT, Mercurial Grabber, and Chaos ransomware used as a wiper against gamers.
45
Vendor
Rockstar Games
- Mentions · 7d0
- Mentions · 30d0
- All mentions7
- First seenAug 24, 2026
- Last mentionedSep 10, 2026
Timeline
7 articles · newest firstFake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers
Huntress found fake GTA 6 installer ISOs spreading NJRAT, DCRAT, Mercurial Grabber and a Chaos ransomware wiper that steals credentials.
47
You Can Now Destroy Flock Cameras for Cash in GTA V
A new GTA V mod installs 235 Flock-style license plate cameras in Los Santos that players can destroy for $600 each.
7
Grand Theft Auto VI hype leads to malware
Fake GTA6 ISO downloads spread via SEO poisoning, torrents, and forums deliver NJRAT, DCRAT, an infostealer, and wiper ransomware.
45
The GTA VI leaks are breaking the internet. Security researchers have seen this before.
A hacker or insider leaked GTA VI gameplay footage before launch, triggering Take-Two DMCA subpoenas against Discord, Google, Microsoft and X.
72
Indian man who fled US arrested on charges he helped scammers siphon $7.5 million from the elderly
US prosecutors charged Indian national Jay Goswami as a money mule who collected $7.5 million from nine elderly scam victims, now facing extradition from Canada.
30
Cybercriminals Turn GTA VI Leaks Into Malware Bait
Attackers spread fake 113GB GTA VI builds whose 50KB payload whitelists the entire C: drive in Windows Defender, alongside credential phishing and infostealer campaigns.
30
Appears with
- Grand Theft Auto VIproduct · 4
- NJRATmalware · 3
- DCRATmalware · 3
- Huntressvendor · 3
- Microsoftvendor · 2
- Huntressorganization · 2
- Windows Defenderproduct · 2
- CyberLeekthreat actor · 2
- Kasperskyvendor · 2
- Mercurial Grabbermalware · 2
- Chaosmalware · 2
- Halcyonvendor · 1
- ScreenConnectproduct · 1
- Luta Securityvendor · 1
- NJRATproduct · 1
- IGNvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.