Fake GTA 6 Installers Deploy NJRAT, DCRAT, Mercurial Grabber and a Chaos Ransomware Wiper Against Gamers

Huntress reports malicious ISOs posing as leaked GTA 6 builds — some exceeding 100 GB and padded with junk data — spreading via SEO poisoning, torrents, forums and social media; they deploy NJRAT, DCRAT and Mercurial Grabber to steal browser passwords,…

Huntress analyzed a malicious ISO disguised as a leaked Grand Theft Auto VI build, distributed via poisoned search results (SEO poisoning), torrent sites, gaming forums and social media to players seeking the game before release; the fake ISO files exceed 100 GB, padded largely with junk data. The installer stages game-named executables in %TEMP% and deploys NJRAT and DCRAT — providing keylogging, screenshots, webcam and clipboard access — plus the Mercurial Grabber infostealer, which harvests browser passwords, cookies, Discord and chat tokens, Roblox and Minecraft session data, Windows product keys and cryptocurrency details, exfiltrating the data via a Discord webhook. A Chaos ransomware variant launched through gta6.exe deletes shadow copies (for admin users), disables Windows recovery, encrypts files up to 200 MB with AES and overwrites files larger than 200 MB with random data, effectively acting as a wiper rather than offering genuine ransom payment paths; GBHackers attributes the wiper to the 'ASHA Hacker Team'. A Visual Basic script displays a fake 'license not found' error to conceal that payloads are already installed. The malware also adds firewall rules, modifies the hosts file to block telemetry and security-reporting services, and uses AWS and ngrok infrastructure, while Russian-language prompts in the fake installers suggest the operators target Russian-speaking gamers.

• Huntress analyzed fake GTA 6 ISOs distributed via SEO-poisoned search results, torrent sites, gaming forums and social media, targeting players seeking a leaked build before release (both reports, 2026-09-10).
• Fake ISO files exceed 100 GB, padded largely with junk data.
• The installer stages game-named executables in %TEMP% and bundles NJRAT, DCRAT, Mercurial Grabber and a Chaos ransomware variant in one package.
• NJRAT and DCRAT provide keylogging, screenshots, webcam and clipboard access; Mercurial Grabber steals passwords, cookies, chat tokens and product keys.
• Stolen data includes browser passwords, Discord tokens, Roblox and Minecraft session data, Windows product keys and cryptocurrency details, exfiltrated via a Discord webhook.
• The Chaos variant launched via gta6.exe deletes shadow copies, disables Windows recovery, encrypts files up to 200 MB with AES and overwrites larger files, functioning as a wiper with no genuine ransom payment path.
• A Visual Basic script displays a fake 'license not found' error while the already-installed payloads run in the background.
• The malware adds firewall rules, modifies the hosts file to block telemetry and security-reporting services, and uses AWS and ngrok infrastructure.