Fake GTA 6 demo sites are spreading password-stealing malware — and there is no real demo
There is no GTA 6 demo — and that is the whole point
With GTA 6 scheduled for November 19 on PlayStation 5 and Xbox Series X|S, and no PC version announced, the hype around the game has created a perfect environment for scammers. Malwarebytes has identified a network of websites impersonating Rockstar Games, appearing in search results for a "GTA 6 demo" and copying the studio's genuine promotional artwork for the August 27 "Extended Look" to look convincing (Malwarebytes). The catch: visitors who follow the sites' "Play Now" buttons end up downloading an executable called `gta6_installer.exe` — which is not a demo, a game or a video, but an information stealer.
The file size alone gives the trick away: the executable is just 1.1 MB, nowhere near enough to contain a modern AAA title (TechRepublic). Rockstar has never announced or released a demo of GTA 6, so any offer of a playable build — "demo", "beta" or "early access" — is fraudulent by definition.
A well-equipped thief: Vidar
Malwarebytes identified the payload as Vidar, a commercially sold infostealer. According to TechRepublic's breakdown, it targets saved passwords, session cookies, browsing history, autofill data and FTP credentials across 19 browsers — including Chrome, Edge, Firefox, Brave, Opera and Vivaldi — as well as Thunderbird profiles, Perplexity's Comet browser and the WebView2 component inside Roblox Studio (TechRepublic).
Stolen cookies are the most dangerous part. Attackers can sometimes reuse an already authenticated browser session without going through the normal login process again, which means two-factor authentication alone is not necessarily enough to protect an account once a session token has been stolen (Malwarebytes).
The scale of the problem: 212 domains and counting
The scam is not limited to a handful of pages. According to research by Surfshark reported by South Korean outlet ETNews, more than 210 GTA 6-related domains have been registered so far, and roughly one in four shows signs of malicious activity — fake pre-order pages, bogus cryptocurrency investments and malware distribution (ETNews). The count has more than doubled in under a month, from about 100 domains at the end of July to 212 by mid-August, and researchers estimate it could exceed 750 before the game launches if the trend continues (ETNews).
A campaign riding the leak wave
Timing tells the story. The first malicious `gta6_installer.exe` sample was spotted on August 19 — just one day after the Cyberleak group began circulating what appears to be genuine GTA 6 gameplay footage and a map of Leonida (Malwarebytes). The leak wave made players believe more unofficial material might be out there, and scammers exploited exactly that expectation. It is not even the first time: earlier this year, fraudsters were charging hundreds of dollars for fake GTA 6 early access (Malwarebytes).
What players should do
The simplest protection is also the most effective: there is no official GTA 6 demo, so any site offering one is fake, however convincing its Rockstar branding looks (TechRepublic). Stick to official channels — the game itself is the only product Rockstar is selling. If you downloaded the file but did not run it, delete it and scan your device. If you did run it, Malwarebytes recommends assuming your browser credentials and active sessions may be compromised: scan the computer, then use a clean device to change important passwords, sign out of active sessions and check your accounts for unfamiliar devices or connected applications (TechRepublic).
With less than three months to go, expect this wave to keep growing alongside the hype. The rule is simple: when it comes to GTA 6, if it looks like a free demo, it is a trap.