Fake download sites expand before GTA 6 release, 121 “CyberLeek” piggybacking domains, Trojan horse detection and crypto asset claims | Security News Security Measures Lab

Regarding the game “Grand Theft Auto VI (GTA 6)” scheduled to be released on November 19, 2026, fake sites have been confirmed that offer free distribution of unreleased versions, early access, and downloads of PC and smartphone versions. A survey published by British cybersecurity company Netcraft on November 3 revealed cases where distributed files were detected as Trojan horses by multiple security products, as well as sites asking for crypto asset transfers and survey responses.

Some fraudulent sites use the name “CyberLeek”, which is said to have released unreleased footage of GTA 6 in August 2026. Netcraft observed 121 newly registered domains with the same name, but not all of these 121 were determined to be fraudulent sites.

According to official information from Rockstar Games, GTA 6 will be released on PlayStation 5 and Xbox Series X|S.Official pre-download is scheduled to start from November 10th.This does not mean that you will be able to play the game before its official release. Be wary of sites that claim to distribute PC, Android, or iOS versions that have not been officially announced.

GTA 6 Fake Download Site Investigation Summary

• Research and publication: Netcraft, November 3, 2026. Among the GTA 6 related domains, sites observed for the first time between July 1st and October 27th are analyzed.
• Techniques: Free download of unreleased builds, advance play rights, PC/smartphone versions, free distribution of game keys, inducement disguised as in-game currency.
• Domain: Observed 121 newly registered domains including “CyberLeek” known for leaking GTA 6 videos. 100 of them were registered in August. Not all sites were confirmed to be fraudulent.
• Suspected malicious file: `GTAVI.exe` distributed from a fake site was detected by 34 out of 68 engines by VirusTotal. Another fake launcher was detected in 18 out of 62 engines.
• Money Demand: Another site asks for the equivalent of USD 100 in crypto assets in order to activate the game. A page selling fake PC/game console keys for 199 USD was also observed.
• Spoofing for Android: Sites that distribute unofficial APKs and encourage users to install apps from unknown sources have also been confirmed. APKs that are not detected during inspection will not be considered legitimate GTA 6 apps.
• Release information: GTA 6 is scheduled to be released on November 19th. Officially supported devices are PS5 and Xbox Series X|S. Pre-download is scheduled to start on November 10th.
• Damage status: Although files have been detected and suspicious billing screens have been observed, it is not possible to calculate the number of infected people, the number of damaged remittances, or the attacker’s revenue from this investigation.

Trojan horse detected on fake “leaked GTA 6” distribution site

What is unique about this investigation is that it uses previously reported leaks of unreleased footage as credibility material for fake downloads.

According to Netcraft, `gta6cyberleek[.]com` was a screen reminiscent of Rockstar Games’ official website, advertising that you can download the full version of GTA 6 for free. A file called `GTAVI.exe` is located in the download destination, and at the time of the investigation, VirusTotal detected 34 out of 68 engines and mainly classified it as a Trojan horse.

Another `cyberleek[.]click` announced that the leaked publication could be used with a special software called “Cyberleek Launcher” and emphasized that it did not contain any malware. However, at the time of the investigation, the launcher was detected in 18 out of 62 engines. They then asked you to send them $100 worth of crypto in order to activate your account and unlock the game. Netcraft observes the payment screen, but does not actually send money.

The “34 cases” and “18 cases” mentioned here are the number detected by the antivirus engine, not the number of infected devices or victims. Additionally, we have not determined that these sites are operated by CyberLeek or its affiliates.

Regarding the unreleased footage of GTA 6, Rockstar Games’ parent company Take-Two Interactive is proceeding with legal procedures to identify the source of the leak. The circumstances surrounding the leak of unreleased footage are as follows:Explanation of GTA 6 video leak and investigation by Take-TwoIt is organized by. However, there is no evidence that the operators of the video leak and this fake distribution site are the same.

Selling advance play rights and PC version game keys with crypto assets

In addition to pretending to give away the game for free, we also found sites that collect money by claiming to be able to play the game before it’s released.

`gta6 investigated by Netcraft[.]exposed` advertised that it would sell game keys for each platform, including PC, for 199 USD and asked for the buyer’s email address and payment in crypto assets. Another`gta6underground[.]com` advertised an “early access program” and posted benefits such as in-game currency. However, when Netcraft checked, the download destination file on the site could not be reached, and the actual distributed file could not be analyzed.

In Brazil, pre-order sites masquerading as Rockstar Games were found, and in some cases users were directed to pay using PIX, a local instant payment method. Fake sites do not necessarily need to distribute malware; their purpose may be to collect payment or personal information without delivering the product.

Beware of unofficial APKs claiming to be “GTA 6 Mobile” and “Android Beta”

Fake download pages for smartphones have also been observed. Rockstar Games has not announced the Android or iOS version of GTA 6 as of November 9th.

For example, `gta6thapk[.]com` advertised that it was offering a beta version of “GTA 6 APK” for Android and directed users to the APK file on GitHub. There was also a guide on the page urging you to change your settings so that you can install apps from unknown sources.

Netcraft’s VirusTotal inspection of the APK has not found any malicious intent at the time of investigation. However, this does not prove that it is a genuine GTA 6 mobile version.The existence of the detected files is one thing, but the fact that all of the unofficial APKs investigated were malware is another.

Other sites have been observed that advertise that they are compatible with both Android and iOS, directing users to external file distribution services, and pages that resemble official app store screens.

“Free code” and “Identity verification” guide you to questionnaires and personal information input

There are also methods that do not directly distribute software, but pretend to be giving away giveaways or distributing game keys.

`mygta6 confirmed by Netcraft[.]icu` and gta6keycodes[.]com` used displays showing the number of game keys remaining and the user’s activity status, making it seem like if you didn’t sign up right away you would miss out on the opportunity. The code will be displayed until halfway through, but when the last character string is checked, “human identity verification” is required, and the user will be moved to procedures such as surveys, app installation, and product testing.

This mechanism is called a “content locker” and may be used to obtain advertising/affiliate fees and personal information. However, the number of people who responded to the displayed survey and the actual revenue were not revealed in this study.

A page pretending to give away the in-game currency “GTA$” was also found. Netcraft has pointed out that the subject matter of guidance may change after release, such as in-game currency, cheats, and disguised support contact information. This is a prediction of the future and does not mean that all attack sites are already operational.

Rockstar official official download starts on November 10th, release date is on the 19th

When identifying fraudulent sites, it is effective to check the products, models, and schedules actually announced by the developer.

According to Rockstar Games’ official FAQ, pre-downloads for the digital version of GTA 6 will begin on PS5 starting November 10, 2026 at midnight (local time in each region). Xbox Series X|S is scheduled to start at midnight (GMT) on the same day. The release date is November 19th, which does not mean you will be able to play the game on the 10th by pre-downloading.

The official announcement does not include the PC version or smartphone version. Advertisements such as “Get the PC version now,” “Official beta for Android,” and “Play the full version before release date” contradict official information. To download or purchase, please go to Rockstar’s official guide and go to the official PlayStation Store, Xbox Store, etc.

What to do if you access and download a fake GTA 6 distribution site

The response differs depending on whether you simply opened the page, retrieved the file, or executed/installed it.

1. For download only: The target EXE or APK will be deleted without being executed. Check your browser’s download history and storage location, and check with security software if necessary.
2. When running on Windows: Consider isolating it from the network and inspecting it with reliable security software. Check the impact not only on your gaming account, but also on credentials stored in your browser and sensitive data on your device.
3. If you install an unofficial APK on Android: Check app permissions, device administrator settings, accessibility permissions, etc., and delete suspicious apps. Consult with official device support or security experts if necessary.
4. If you enter login information or personal information: Check the service that uses the same password as the one you entered, and change it from the official site. Enable two-factor authentication and also check your account’s session/login history.
5. When sending crypto assets: We will save the remittance address, transaction ID, site display, and transaction records, and contact the exchange you used and the police consultation center. Don’t respond to anyone who asks for additional fees under the guise of a refund.

If you run the installer on a terminal at work, please contact the information systems department/CSIRT and share the download source, time of execution, file name, warning screen, etc. before initializing it on your own. For devices connected to the workplace network, authentication information and spillover to the business cloud will also be investigated.

For another example of an attack using a fake product distribution page, seeMalware spread through DeepSeek fake download siteBut it is explained.

source

Posted by: Mimura

Worked for 8 years in SOC (Security Operation Center) management and web application vulnerability diagnosis at a listed company that handles security products. After that, he became a system engineer and was involved in the development of MDM and HR SaaS.

Utilizing 8 years of practical experience and knowledge as a developer, the Security Measures Lab oversees dark web research, security incident analysis, and writing and editing of advanced security measures explanations.

LinkedIn (external site)