Fake GTA 6 Downloads Deliver RATs, Infostealers, and Wipers

Key Takeaways

• Cybercriminals are distributing fake Grand Theft Auto VI downloads that install multiple malware strains.
• The malicious packages include remote access Trojans (RATs), information stealers, and data-wiping ransomware.
• The campaign targets eager gamers searching for early access, leaked copies, or unofficial demos of the highly anticipated game.
• The ransomware component acts as a wiper, making files unrecoverable rather than offering a genuine decryption path.

Overview: Fake GTA 6 Downloads Deliver Multiple Threats

Cybercriminals are capitalizing on the immense anticipation surrounding Grand Theft Auto VI by circulating fraudulent game downloads. Instead of providing access to the highly sought-after title, these malicious packages infect victims with a dangerous cocktail of malware, including remote access tools, information stealers, and data-wiping ransomware. The campaign specifically targets individuals seeking early builds, leaked versions, or unofficial demos ahead of the game’s official release.

These deceptive downloads are propagated through various channels, such as manipulated search engine results, gaming forums, torrent sites, and social media platforms. Some of the fake ISO files boast sizes exceeding 100GB, a deliberate tactic to enhance their credibility, with much of the volume comprising inert junk data.

Analysts at Huntress said in a report that they identified a sample combining remote-access malware, an information stealer, file-destroying ransomware, and an additional web browser within a single malicious package. The presence of Russian-language prompts and a Russian ransom note suggests that this operation might primarily target Russian-speaking gaming communities, as detailed in a report.

This incident underscores how highly anticipated game releases can become a significant vector for device compromise, mirroring past campaigns that exploited player eagerness with fake GTA 6 demos.

Infection Chain and Malware Payload

The infection process commences when a user mounts the fraudulent game image and executes what appears to be an installer. The main executable uses an outdated GTA 5-style icon and initially displays a Russian message, falsely claiming that the “leaked” game might not run due to an invalid crack. This message is a deceptive ploy. Upon completion of the “installation,” victims encounter a “license not found” error, providing a plausible, albeit false, explanation for the game’s failure to launch, while the malicious payloads silently deploy in the background.

This calculated delay in revealing the malware’s true nature allows the attackers more time for their payloads to execute. The package drops several files into the Windows temporary directory and verifies internet connectivity before proceeding with further stages of the attack.

The attackers then install multiple instances of NJRAT, a versatile remote-access Trojan. NJRAT grants attackers extensive control over the compromised system, enabling them to log keystrokes, capture screenshots, access webcams, browse files, exfiltrate browser data, and remotely manipulate the operating system.

Additionally, the campaign deploys DCRAT, another remote-access tool. DCRAT’s capabilities include monitoring active windows, capturing clipboard contents, discovering audio devices, and modifying registry settings. Notably, DCRAT alters the Windows hosts file to block specific telemetry and security-reporting services, a tactic designed to reduce the likelihood of the infection being detected or reported.

A separate component, Mercurial Grabber, focuses on data exfiltration. It systematically collects browser passwords and cookies, chat-platform tokens, game-related session data, screenshots, detailed system information, location data, and Windows product keys. This campaign exemplifies the broader threat posed by SEO-poisoned download campaigns, where seemingly legitimate search results direct users to weaponized installers.

Ransomware Used as a Wiper

The most destructive element of this malicious package is Chaos ransomware. However, the attackers do not appear to be interested in extorting payments. Instead, the malware functions as a wiper, encrypting smaller files and overwriting files larger than 200MB with random data, rendering them effectively unrecoverable.

If the compromised user possesses administrator privileges, the malware takes additional steps to ensure data destruction. It deletes shadow copies and disables system recovery options before initiating the file destruction process. The ransomware targets critical personal folders, shared data locations, saved game files, and cloud-synchronized storage, leading to potentially devastating data loss that can extend beyond the infected device itself.

The ransomware leaves behind a ransom note asserting that files are “encrypted forever,” rather than providing a legitimate path to recovery. This behavior makes the campaign particularly dangerous for gamers, who might anticipate only password theft but instead face the permanent loss of documents, photos, game saves, and locally stored work files.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Avoid Unofficial Downloads: Always download games, especially highly anticipated titles, exclusively from official publisher websites, verified digital storefronts (like Steam, Epic Games Store, PlayStation Store, Xbox Store), or trusted platform channels. Never trust alleged “leaked builds,” torrent listings, or social media posts promising early access.
• Be Skeptical of Search Results: Exercise caution with download links from unfamiliar search results, as these can be manipulated through SEO poisoning to lead to malicious installers.
• Isolate Infected Devices: If you suspect you have run a malicious GTA 6 installer, immediately disconnect the affected device from all networks (Wi-Fi and Ethernet) to prevent further compromise or spread of malware.
• Change Passwords: From a clean, uncompromised device, change all passwords for accounts that may have been accessed on the infected machine

  Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.

  Tags:

  AttackExploitMalwareransomwareSecurityThreat