Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers
Huntress found fake GTA 6 installer ISOs spreading NJRAT, DCRAT, Mercurial Grabber and a Chaos ransomware wiper that steals credentials.
Huntress analyzed a malicious ISO disguised as a leaked GTA 6 build, distributed via SEO poisoning, torrent sites, and social media, with some images exceeding 100 GB and padded with junk data. The installer stages game-named executables in %TEMP% and deploys NJRAT, DCRAT, and the Mercurial Grabber infostealer, harvesting browser passwords, Discord tokens, Roblox and Minecraft session data, Windows product keys, and cryptocurrency details, with exfiltration via a Discord webhook. A Chaos ransomware variant launched through gta6.exe deletes shadow copies, disables Windows recovery, encrypts files up to 200 MB with AES, and overwrites larger files, effectively acting as a wiper attributed to the 'ASHA Hacker Team'. A Visual Basic script displays a fake 'license not found' error to conceal the already-installed payloads.
- Huntress traced SEO-poisoned fake GTA 6 ISOs, some over 100 GB and padded with junk data, through torrents and forums.
- Installer drops NJRAT and DCRAT plus Mercurial Grabber, stealing browser passwords, Discord tokens, game sessions, and crypto data.
- Chaos ransomware variant acts as a wiper: deletes shadow copies, disables recovery, encrypts files up to 200 MB.
- A Visual Basic script displays a fake 'license not found' error to hide that payloads already installed.
- Malware adds firewall rules, uses AWS and ngrok infrastructure, and exfiltrates stolen data via a Discord webhook.
- ATT&CK
- T1204.002 User Execution: Malicious FileT1036 MasqueradingT1555.003 Credentials from Web BrowsersT1486 Data Encrypted for ImpactT1562.001 Impair Defenses: Disable or Modify Tools
- Vendors
- Rockstar Games
- Threat actors
- ASHA Hacker Team
- Organizations
- Huntress
- Countries
- Russia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 15eca4a3f7350423cf4db0b4c30d1968 | 6ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e3 |
| md5 | 2a0834560ed3770fc33d7a42f8229722 | ckstargamescrashfixer.exe %TEMP%\rockstarservices.exe MD5s: 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651 |
| md5 | 2a385fe7bed9899d77d05cb8e302d557 | a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 Copies of NJRAT and associated launchers Note: IP addresses |
| md5 | 57b9c56ef97a7ada98257b23577bf5e3 | rockstarservices.exe MD5s: 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c3 |
| md5 | 60a0f58001ea7be538cd42b651924cc7 | 560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee |
| md5 | 6b49f24d5d5b49127476bc385565f8b0 | llation executable %TEMP%\checkinternetconnection.bat MD5 : 6b49f24d5d5b49127476bc385565f8b0 BAT file used to confirm a working internet connection %TEM |
| md5 | a15e280a3fd65dfaa243bbe2dbf45e97 | -clean media. IOCs Item Description Gta6installer.exe MD5 : a15e280a3fd65dfaa243bbe2dbf45e97 Initial installation executable %TEMP%\checkinternetconnect |
| md5 | ea991bc9334b36a6b958f564ee716776 | 8001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 Copies of NJRAT and associ |
From the original article
4 min read at gbhackers.com
Threat actors are exploiting anticipation around Grand Theft Auto VI by pushing fraudulent “leaked” game downloads that install a layered malware bundle that steals browser credentials, Discord tokens, gaming-session data, and cryptocurrency-related information. A Chaos ransomware variant used as a wiper, and an unexpected Yandex Browser installer. The campaign demonstrates how cybercriminals are turning one […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.