Cybercriminals are taking advantage of the excitement surrounding "GTA 6" by pushing fake websites that claim to offer a playable demo of the game.
'GTA 6' Demo Is Fake, Brings Malware to PCs
Malwarebytes shared a new report saying that it identified a network of websites appearing in search results for "GTA 6" demo downloads, closely mimicking Rockstar's branding and messaging.
Visitors who click the "Play Now" buttons on these sites are directed to download a file called "gta6_installer.exe," which does not contain a demo, game, or video of any kind.
Instead, it installs an information stealer built to extract passwords, cookies, and authenticated sessions saved inside a person's web browser.
The malware belongs to the 'Vidar' family, a well-known infostealer that is sold as a service to other cybercriminals. Once installed, it searches through 19 different browser targets, including Chrome, Edge, Firefox, Brave, Opera, and Vivaldi, along with Thunderbird's email profiles and even the browser embedded inside Roblox Studio.
One of the more concerning aspects of this malware is how it handles browser encryption. Rather than trying to break into protected password databases directly, it launches the real Chrome, Edge, or Firefox executables already installed on a victim's system in headless mode, then extracts data through that legitimate process before deleting the temporary files it created.
Because stolen session cookies can sometimes be reused without a fresh login, Malwarebytes warned that even two-factor authentication may not be enough to stop an attacker who has already obtained one.
'GTA 6' Is Only on PlayStation, Xbox Consoles
There is currently no legitimate demo of "GTA 6" available anywhere, and Rockstar has not announced plans to release one, as per Engadget's report. The game is scheduled to launch on November 19 for PlayStation 5 and Xbox Series X/S, with no PC version currently announced.
Anyone claiming to offer a downloadable "GTA 6" demo, especially one just over one megabyte in file size, as Malwarebytes noted the fake installer was, should be treated as an immediate red flag.
This is not the first scam tied to "GTA 6" this year either. Malwarebytes previously reported on fraudsters charging people hundreds of dollars for fake early access to the game earlier in 2026.
The latest wave appears to have accelerated after gameplay footage and an alleged map of Leonida, the game's setting, began circulating online on August 18 through a group calling itself Cyberleek. Rockstar and Take-Two responded with copyright takedowns, and the malicious installer was first spotted just one day after that material started spreading, suggesting attackers moved quickly to capitalize on the renewed public interest.
Netflix and Rockstar's 'GTA 6' Extended Look
The scam sites are specifically designed to piggyback on a real, officially confirmed event. Rockstar has an Extended Look at "GTA 6" premiering on Netflix, which is scheduled to become available on the platform before later appearing on Rockstar's own YouTube channel the same day.
That footage is meant to be watched, not downloaded or played as an interactive demo, and Malwarebytes emphasized that this distinction is exactly what the fake sites are counting on people to overlook.
To stay safe, Malwarebytes recommends downloading games and demos only through official storefronts like Steam, the Epic Games Store, or a publisher's own verified website.
Anyone who already ran the fake installer is advised to scan their device with a trusted security tool, change important passwords from a separate clean device, and sign out of active sessions across their accounts.
