Fake GTA 6 Extended Look and demo sites deliver an infostealer

This threat involves fake websites impersonating Rockstar Games to distribute a malicious executable named gta6_installer.exe, which is a Vidar infostealer. The malware targets 19 different browsers including Chrome, Edge, and Firefox to steal browser-saved passwords, cookies, authenticated sessions, autofill data, and FTP credentials. It uses legitimate browser binaries in headless mode to access protected data, increasing the effectiveness of credential theft. Stolen session tokens enable attackers to bypass two-factor authentication and maintain persistent access to victim accounts. The campaign is timed to exploit the hype and recent leaks of GTA 6 content starting August 18, 2026.

The malware compromises user credentials and session tokens from multiple browsers, enabling attackers to hijack accounts and access sensitive information without triggering two-factor authentication. This can lead to persistent unauthorized access even after password changes. The theft of FTP credentials and autofill data further increases the risk of broader compromise. The campaign exploits user trust in official-looking promotional sites, increasing the likelihood of infection.

No official patch or fix is applicable as this is a malware campaign leveraging social engineering. Users should avoid downloading software from unofficial or suspicious websites, especially those claiming to offer early access or demos of unreleased games. Security teams should block known malicious domains associated with this campaign and educate users about the risks of fake download sites. Use endpoint protection solutions capable of detecting Vidar infostealer variants. Monitor for unusual authentication activity that may indicate session hijacking.