Fake GTA 6 download delivers WARDEN Stealer for logins and wallets
Original title: Fake GTA 6 download goes after Steam logins and crypto wallet data
A Google Colab lure leads to a ZIP whose executable steals browser, Steam, Roblox and crypto data and can fetch more malware.
Cynet traced a “GTA 6 EXE file download” link from a Google Colab notebook to a ZIP on a page called “Windows Software Hub.” The archive held a small executable and a README that tells users to run as administrator and add an antivirus exclusion. The binary has no game engine, assets or Rockstar signatures. It checks for a virtual machine or sandbox, injects into browser processes, replaces copied cryptocurrency addresses and can download more malware. Cynet named uroker[.]casa as the probable command-and-control server and published SHA-256 hashes, while warning that 104.21.75[.]176 is a shared Cloudflare address.
Unconfirmed: Cynet calls uroker[.]casa the probable, not confirmed, command-and-control server.
- Grand Theft Auto VI launches November 19 with no PC version.
- The page advertised a 72 MB download; the archive held a 796 KB executable and a 1 KB README.
- The README tells users to bypass a security warning and exclude the file from antivirus.
- Cynet warned against blocking shared Cloudflare IP 104.21.75[.]176.
Impact: Steals saved passwords, cookies, game logins and crypto wallet data
- 1.Block uroker[.]casa, named as the probable command-and-control server.
- 2.Do not block 104.21.75[.]176; Cynet says it is a shared Cloudflare IP.
- 3.Treat any offered PC installer for GTA 6 as unrelated to the game.
- Vendors
- Rockstar
- Products
- Grand Theft Auto VISteamRoblox
- Malware
- WARDEN Stealer
- Organizations
- Cynet
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | uroker.casa | d, and can download more malware. What to block Cynet named uroker[.]casa as the probable command-and-control server, which is the |
| ipv4 | 104.21.75.176 | 56 hashes for the executable and the README. It also listed 104.21.75[.]176 but warned against blocking that address because it is a |
From the original article
1 min read at helpnetsecurity.com
Cynet researchers followed a “GTA 6 EXE file download” link from a Google Colab notebook to a ZIP archive and found a WARDEN Stealer loader inside. The malware takes saved passwords, browser cookies, Steam and Roblox credentials, and cryptocurrency wallet data from the machine it runs on.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.