Fake GTA 6 demo websites are spreading Vidar password-stealing malware disguised as a Rockstar Games download
Malwarebytes and an independent reverse-engineering analysis found fake Rockstar Games $TTWO GTA 6 demo sites delivering a Vidar-family infostealer that steals browser passwords and session cookies and may bypass 2FA.
Malwarebytes identified a network of fake websites impersonating Rockstar Games $TTWO that appear in searches for a GTA 6 demo. Visitors who click the sites' 'Play Now' buttons download gta6_installer.exe, a 1.1 MB file that is not a game but an infostealer from the Vidar malware family. Vidar is designed to steal passwords, session cookies, browsing history and autofill data from browsers, and Malwarebytes found it targets 19 browser types including Chrome, Edge and Firefox. An independent reverse-engineering analysis of the same file, matching Malwarebytes' file hash, additionally found the malware targets Discord tokens, Telegram data, cryptocurrency wallets, FTP credentials and cloud login tokens. Because the malware can steal active session cookies rather than only passwords, Malwarebytes says stolen sessions can sometimes be reused without triggering two-factor authentication again. Malwarebytes first spotted the malicious installer on August 19, 2026, one day after unrelated GTA 6 gameplay footage began circulating online; researchers stress no link has been established between whoever leaked that footage and whoever built the malware sites. There is no legitimate GTA 6 demo: the game releases November 19, 2026 on PlayStation 5 and Xbox Series X|S, and Rockstar's official 'Extended Look' premieres on Netflix on August 27, 2026. Sources: Malwarebytes Threat Intel (Aug 24, 2026), independent reverse-engineering analysis by devmihaylov (Medium).