Scammers are exploiting the hype surrounding Grand Theft Auto VI by advertising fake leaked builds, early copies and non-existent mobile versions weeks before the official November 19 launch.
Fake downloads and domain abuse
Netcraft examined domains that referenced the game between July 1 and October 27, 2026. The analysis identified dozens of sites that borrowed the name of well-known leaker CyberLeek or claimed to provide free or early access, and many of those sites mimicked the visual style of official Rockstar pages.
Four main lure types emerged: sites using the leaker’s moniker, pages promising early downloads, ads for mobile versions that do not exist, and offers to give the game away at no cost. Each category was designed to appear credible to fans searching for a shortcut.
Many of these pages either delivered malware or hid the promised file behind a content locker that forces visitors through surveys and affiliate offers. Netcraft visited each site without paying, completing offers or linking a crypto wallet to assess the threats, and documented how the lockers redirected users to additional advertising networks.
Cryptocurrency extortion and mobile bait
A wallet prompt appearing on a page signals a risky lure, though it does not prove the site will drain a wallet.
Similar scams have accompanied other high-profile releases. For example, the 2020 launch of a major open-world game saw fake early-access downloads spreading ransomware, showing that hype alone can lure users into dangerous shortcuts and that the pattern repeats with each blockbuster title.
One site, gta6cyberleek.com, mimicked Rockstar’s design and offered a file named GTAVI.exe. VirusTotal flagged the file as a trojan in 34 of 68 security engines, indicating a high likelihood of infection. Another domain, cyberleek.click, claimed its launcher was clean but demanded a $100 cryptocurrency payment to unlock the game, turning the lure into a direct extortion scheme.
Read Also: Security Certifications Misinterpreted as Blanket Security Guarantees
In September, security researchers reported a bogus GTA 6 download that installed remote-access trojans, an infostealer and a Chaos ransomware variant. A separate scam listed the game for any platform, including PC, at $199 in crypto, despite Rockstar’s statement that no PC version exists, which further confused potential victims.
Guidance for gamers
Rockstar has confirmed GTA VI will launch only on PlayStation 5 and Xbox Series X|S, with no early-access build. Yet sites such as gta6.exposed continue to sell “preorder” packages that promise access on unsupported platforms, exploiting the desire for an advantage.
Polished preorder pages and familiar payment flows can persuade users to pay for a version that will never be delivered. Malwarebytes observed a June operation offering early access for $250 in cryptocurrency, using the same deceptive tactics and funneling funds into untraceable wallets.
Mobile-version scams also thrive. Some pages provide Android APK files and urge users to enable installations from unknown sources, while others hide downloads behind “Human Verification” pop-ups that collect email addresses and other personal data. Giveaway sites like mygta6.icu display fake key counters and require users to complete offers before revealing a partial code, turning curiosity into a data-harvesting exercise.
Leaker activity and emerging credential scams
On August 18, an unidentified individual or group began posting apparent GTA VI gameplay clips. The releases consisted solely of footage and images, with no downloadable game available. Since those first clips appeared, 121 newly registered domains have incorporated the name “cyberleek,” and 100 of those were created in August alone.
Netcraft predicts that after title launches, the focus of scams will shift from obtaining the game to gaining advantage within it. Fake offers of GTA$ are expected to increase, and some schemes may request Rockstar, PlayStation or Xbox login details under the guise of a bonus. Reused passwords could grant access to other accounts, while saved payment information might be exploited for unauthorized purchases.
Leave a Reply