Fake GTA 6 leaks and phone downloads push malware and crypto payment scams
Netcraft found sites using supposed GTA 6 leaks, early access and free copies to distribute suspicious downloads or demand cryptocurrency and personal details. Some files were flagged as malware, but the research does not establish how many people were infected or lost money. Rockstar has announced the game for PlayStation 5 and Xbox Series X|S, with no PC or phone version announced.
Supposed leaks and early copies are being used to push suspicious downloads and cryptocurrency payments. Families should check any offer against Rockstar’s announced platforms and release schedule before installing or paying.
What happened
Before anyone in your family installs a supposed GTA 6 leak, check where it came from. Scammers are promising early copies, free games and phone versions to draw people into downloads, cryptocurrency payments and requests for personal details, according to Help Net Security’s 5 November report[1].
- HARD alert level
- High Malware and payment scams
- Announced launch
- 19 November 2026
- Announced platforms
- PlayStation 5 and Xbox Series X|S
- PC and phones
- No PC, Android or iPhone version announced
- Official preloading
- Begins 10 November; start times differ by console
Timeline
-
HARD publishes its article, at High.
Who is affected
This warning is for anyone looking for a way to play before launch, including people offered a version for their computer or phone. Parents should ask about downloads on the family computer as well as games bought for a console.
A convincing logo is not enough. Kaspersky’s separate investigation[4] found sites copying Rockstar and PlayStation branding. It also found supposed free game codes that revealed only a few characters before demanding an app installation as “human verification”.
What the research confirms
Netcraft’s 3 November research[5] examined GTA VI-themed domains first seen between 1 July and 27 October 2026. A Windows file called GTAVI.exe was flagged by 34 of 68 security engines on VirusTotal, mostly as a trojan, when checked. Another launcher demanded US$100 in cryptocurrency to unlock the supposed game; Netcraft did not pay.
The findings have limits. One supposed Android version had no malware detections when Netcraft checked it. That did not make it an official game. Netcraft also cautions that a wallet connection prompt alone does not prove a site steals cryptocurrency.
Official preloading is a separate, legitimate process. Downloading a purchased game ahead of release does not mean you can play it early. Follow Rockstar’s instructions through your console’s store, rather than a website offering a special launcher.
What to do this week
- Start with the official store.Use the PlayStation or Xbox store directly, or follow links from Rockstar’s own game page. Reject offers of leaked builds, phone versions or cryptocurrency activation.
- Ask before anyone installs.Check with family members about supposed GTA 6 launchers, installers and mobile downloads. Do not switch off security protections to make one work. Kaspersky specifically warns against sites asking people to ignore warnings or disable protection.
- If someone ran a suspicious file, isolate the device.Disconnect it from the internet and other devices. Get help checking and removing malware before using it for sensitive accounts. Australia’s malware recovery guidance[6] recommends changing affected passwords from a device free of malware, starting with important accounts such as email and banking.
- If someone entered a password, secure that account.Open the service’s official app or website from a trusted device. Replace the password and any reused copies, sign out other sessions where available, and turn on two-factor authentication. Follow the Australian account recovery guidance[7].
- If someone paid, stop further payments.Contact the bank or card provider immediately if either was involved. Report the scam and watch for anyone offering to recover the money for a fee. Scamwatch explains the next steps[8].
Related
Situations
- Fake Amazon, Walmart, PlayStation gift card offers pay nothing and may add subscriptions Scam, watch, 7 Nov 2026
- FTC scam call: 'a phone in your name is used for crimes abroad' is a scam, so hang up Scam, watch, 7 Nov 2026
- Fake OpenAI, SpaceX and Anthropic event invites steal Microsoft 365 and Google logins, even past two-factor Scam, high, 7 Nov 2026
- Hijacked at the registrar: crypto sites bought through Name.com and Vercel served a wallet drainer Scam, high, 1 Nov 2026
- Every situation, in the Situation Room
References
- ^ Help Net Security (). “Scammers capitalize on GTA 6 hype to push malware and crypto cons”. The supplied report on fake leaks, early access, phone downloads and crypto demands.
- ^ Rockstar Games. “Grand Theft Auto VI”. Official launch date and announced consoles.
- ^ Rockstar Games (). “Grand Theft Auto VI Pre-Load FAQ”. Official preloading begins on 10 November, with different console start times.
- ^ Kaspersky (). “Grand Scam Auto: how scammers target GTA VI fans before its release”. Independent examples of impersonation, fake codes and unsafe installation requests.
- ^ Netcraft (). “How Attackers are Capitalizing on the Hype Around the 'Grand Theft Auto VI' Release”. Primary investigation: downloads, payment demands, mobile lures and evidential limits.
- ^ Australian Signals Directorate’s Australian Cyber Security Centre (). “Detect and remove malware”. Device isolation, malware removal and password changes from a clean device.
- ^ Australian Signals Directorate’s Australian Cyber Security Centre (). “Recover from email and online account compromise”. Official account recovery, unique passwords, session sign-outs and stronger authentication.
- ^ Scamwatch. “What to do if you've been scammed”. Stop payments, contact the bank, report the scam and avoid recovery scams.
Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.