GTA 6 fake demo sites drop Vidar, a stealer reading 19 browsers

Malwarebytes named four domains on August 24, 2026 that dress themselves up as Rockstar Games and hand out a password stealer: gta6demo[.]asia, gta6demo[.]eu, gta6demo[.]us and rockstar-gta-6[.]com. The pages lift the promotional material from the An Extended Look announcement, and their Play Now button downloads a file named gta6_installer.exe. There is no Grand Theft Auto VI demo.

So the word demo inside the address is proof of the fake by itself. Rockstar Games has announced no demo, no beta and no early access, and the pre-order announcement of June 24, 2026, issued by Take-Two, names the platform stores and retailers, and no other channel, for the two editions of the game. No PC version has been announced to date either, so an install file you download cannot have come from Rockstar.

gta6_installer.exe weighs 1.1 megabytes, a figure with no relation to installing a game of this scale. The campaign was spotted on August 19, 2026, the day after stolen gameplay videos first went online.

What arrives is Vidar, a credential stealer sold on subscription. Malwarebytes counts 19 browsers on its target list, Chrome, Edge and Firefox among them, and it relaunches legitimate browsers with no visible window, reading saved passwords out through a process the machine already trusts. Session cookies and browsing history leave with them.

Deleting the file does not close the door. Malwarebytes puts it in one line:

An infostealer doesn’t need to remain on your computer to cause lasting damage

A stolen session cookie opens an account without ever asking for a password. No victim count has been published.

The fake copy that wipes files instead of stealing them

Huntress pulled apart an ISO image sold as an early copy of GTA 6, in work reported by Help Net Security on September 10, 2026: the main file, gta6installer.exe, still carries the GTA V icon, and a message in Russian warns of a “License not found” error while the payload installs in the background.

The Russian-language message, and a copy of the Yandex browser tucked inside the image, lead Huntress to place Russian-speaking users among the targets. SocPrime puts it more firmly on September 11, 2026: the campaign appears to aim primarily at Russian-speaking gamers. Neither publishes a measurement behind it, and Malwarebytes reports nothing of the kind on the four fake demo sites.

Those images move through gaming forums, torrent sites and social channels, and through pages pushed to the top of search results by SEO poisoning, Huntress reports. Some run past 100 GB, which is what makes the download look genuine, while the malware inside takes up a sliver of that.

Alongside the NJRAT and DCRAT remote access trojans and the Mercurial Grabber infostealer sits a Chaos ransomware variant that asks for no payment at all: it encrypts files of 200 MB and under, overwrites anything larger with random data, deletes shadow copy backups and disables Windows recovery options. Huntress found the operators “effectively utilizing the ransomware as a wiper”.

Mercurial Grabber collects Discord tokens, Chrome passwords and cookies, Roblox and Minecraft session data and Windows product keys. NJRAT logs keystrokes, opens the camera and reaches cryptocurrency wallet details.

Most of the files date back to 2023, and Huntress says an up-to-date Windows Defender should catch them. For a machine that is already infected, the drill comes down to four steps: pull it off the internet, reset every password, turn on two-factor authentication wherever it is offered, and reimage the system from scratch.

A Surfshark study, reported by Frandroid on September 1, 2026, separately counts 212 domain names tied to GTA 6, 57 of them fraudulent, and expects the total to pass 750 by launch day.