GTA 6 launches Thursday. The fake PC download is already waiting, and half your IT team will be playing.

01 There is no PC version. Every PC download is fake

That makes the job easy for a scammer. Millions of people want the game on a computer, and nobody can sell it to them legitimately. So the offers fill the gap: a “leaked PC build”, an “extended look demo”, early access keys, a mobile version, a free copy behind a survey.

Netcraft tracked new GTA VI domains from 1 July to 27 October 2026. It counted 121 new domains carrying the name of one self-styled leaker, “Cyberleek”, 100 of them registered in August. One site, gta6cyberleek[.]com, offered a file called GTAVI.exe that 34 of 68 antivirus engines on VirusTotal flagged, mostly as a trojan. Another, gta6[.]exposed, sold the game for “any platform, PC included” for $199 in crypto [ Netcraft ] .

02 What the fake installers steal

Two pieces of research show what actually runs when someone takes the bait.

The Vidar sample is built to be quick. It opens the real Chrome, Edge and Firefox in the background, reads what they hold and leaves no persistence behind [ Malwarebytes ] . By the time the victim realises the “installer” did nothing, the data has gone. Malwarebytes also notes the attackers can buy ads, so the fake site can sit above the real one in a search.

The Huntress sample is the opposite: loud and destructive. Two remote-access trojans give the attacker a live hand on the machine. The Chaos variant encrypts smaller files, overwrites larger ones and deletes the shadow copies Windows uses for recovery [ Huntress ] .

03 From one gamer to your company’s logins

Picture Thursday evening. A developer, an account manager or your IT admin finishes work and searches “GTA 6 PC download” on the laptop in front of them, which is the company’s. They click the second result. Nothing seems to happen.

The stealer has already copied every password the browser saved and, more usefully, every session cookie. A session cookie is the token that says “this person already logged in and passed MFA”. Paste it into another browser and the attacker is inside Microsoft 365, Slack, the CRM, the cloud console or the VPN portal, with no password and no MFA prompt.

Personal devices count too. If staff open work email or Teams on a home PC, the stealer takes those sessions just the same.

04 The launch is a long weekend for your defenders

Release day is a Thursday. A lot of people will take Thursday and Friday off. Many of the people who keep companies safe grew up on this series: sysadmins, developers, the analyst on the night shift. Expect a four-day weekend with thin cover, and plenty of people who show up but are not really there.

Attackers already plan around this. In Semperis’s 2025 study, 52% of organisations hit by ransomware were attacked on a weekend or holiday. 78% cut their security operations staffing by at least half at those times, and 6% had no off-hours cover at all [ Semperis ] . An unofficial “GTA weekend” gives an attacker the same gap without a public holiday.

Put the two halves together. Credentials stolen on Thursday night get used on Friday or Saturday, when the alert lands in a shared inbox nobody opens until Monday.

05 Rockstar learned this the expensive way

The company that makes the game has been here. In September 2022 an intruder got into Rockstar’s systems and posted what he said were 90 clips of early GTA 6 footage, which he claimed came from the company’s Slack. Take-Two confirmed a “network intrusion” and the theft of early development footage [ Malwarebytes, 2022 ] .

The attacker, an 18-year-old member of the Lapsus$ group, was given an indefinite hospital order in December 2023. Rockstar told the court the hack cost it $5 million to recover from, plus thousands of hours of staff time [ VGC ] . He did it from a hotel room with a phone and a TV streaming stick. Lapsus$ made its name by talking its way past staff and their MFA, which is the same weak point the GTA 6 scams go after.

06 Seven things to do before Thursday

After launch, the lures change. Netcraft expects fake GTA$ offers, cheat downloads, fake Rockstar support pages and phishing for PlayStation and Xbox logins [ Netcraft ] . The first line of the checklist stays true for months.

Want to know what one stolen session would open in your company? Our free external exposure audit shows what an attacker sees from outside. A penetration test starting from a standard user’s login shows how far they get once a stealer has done its job, and gives you the fix for every step.