Fake GTA 6 Extended Look and demo sites deliver an infostealer
Cybercriminals are exploiting the hype surrounding Grand Theft Auto VI by creating fake Rockstar Games websites that appear in search results offering a GTA 6 demo. These sites impersonate legitimate promotional material for Rockstar's official Extended Look scheduled for August 27 on Netflix. Visitors who click 'Play Now' buttons download gta6_installer.exe, a Vidar infostealer. The malware steals browser-saved passwords, cookies, authenticated sessions, autofill data, and FTP credentials from 19 different browsers including Chrome, Edge, and Firefox. The executable uses legitimate browser binaries in headless mode to access protected data, making credential theft more effective. Stolen session tokens can be reused without triggering two-factor authentication, allowing attackers persistent access even after password changes. The campaign exploited recent GTA 6 leaks that began circulating August 18.
Indicators of Compromise
- domain: brr.1001gacor.org
- domain: rex.1001gacor.org
- domain: kra.1001gacor.org
- domain: bob.1001gacor.org
- domain: ket.sm188daftar.mom
- domain: ljr.1001gacor.org
- domain: zaf.sm188dnsx.top
- domain: zaf.11gokil.org
- domain: sii.sm188dnsx.top
- domain: ges.1001gacor.org
- domain: sii.11gokil.org
- domain: tax.11gokil.org
- domain: tax.sm188dnsx.top
- domain: ses.1001gacor.org
- domain: ket.1001gacor.org
- domain: dez.11gokil.org
- domain: sto.1001gacor.org
- domain: bib.1001gacor.org
- domain: nhg.1001gacor.org
- domain: gta6demo.asia
- domain: gta6demo.eu
- domain: gta6demo.us
- domain: rockstar-gta-6.com
- hash: a8f19d598e6a49d8510d73d41fc445246755ed321c2f76985a463a9fef537eb0
- hash: 8b8f661341a7699e6fc65c8dfdf3af6e
- hash: 12456ee7204a782bf776ff5279316c26b33ec762
Fake GTA 6 Extended Look and demo sites deliver an infostealer
Description
Cybercriminals are exploiting the hype surrounding Grand Theft Auto VI by creating fake Rockstar Games websites that appear in search results offering a GTA 6 demo. These sites impersonate legitimate promotional material for Rockstar's official Extended Look scheduled for August 27 on Netflix. Visitors who click 'Play Now' buttons download gta6_installer.exe, a Vidar infostealer. The malware steals browser-saved passwords, cookies, authenticated sessions, autofill data, and FTP credentials from 19 different browsers including Chrome, Edge, and Firefox. The executable uses legitimate browser binaries in headless mode to access protected data, making credential theft more effective. Stolen session tokens can be reused without triggering two-factor authentication, allowing attackers persistent access even after password changes. The campaign exploited recent GTA 6 leaks that began circulating August 18.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-gta-6-extended-look-and-demo-sites-deliver-an-infostealer"]
- Adversary
- null
- Pulse Id
- 6a8d3fe4a1d4c2fb6cd421c2
- Threat Score
- null
Indicators of Compromise
Domain
| Value | Description | Copy |
|---|---|---|
domainbrr.1001gacor.org | — | |
domainrex.1001gacor.org | — | |
domainkra.1001gacor.org | — | |
domainbob.1001gacor.org | — | |
domainket.sm188daftar.mom | — | |
domainljr.1001gacor.org | — | |
domainzaf.sm188dnsx.top | — | |
domainzaf.11gokil.org | — | |
domainsii.sm188dnsx.top | — | |
domainges.1001gacor.org | — | |
domainsii.11gokil.org | — | |
domaintax.11gokil.org | — | |
domaintax.sm188dnsx.top | — | |
domainses.1001gacor.org | — | |
domainket.1001gacor.org | — | |
domaindez.11gokil.org | — | |
domainsto.1001gacor.org | — | |
domainbib.1001gacor.org | — | |
domainnhg.1001gacor.org | — | |
domaingta6demo.asia | — | |
domaingta6demo.eu | — | |
domaingta6demo.us | — | |
domainrockstar-gta-6.com | — |
Hash
| Value | Description | Copy |
|---|---|---|
hasha8f19d598e6a49d8510d73d41fc445246755ed321c2f76985a463a9fef537eb0 | — | |
hash8b8f661341a7699e6fc65c8dfdf3af6e | — | |
hash12456ee7204a782bf776ff5279316c26b33ec762 | — |
Threat ID: 6a8d73d1acd9273b490ff89c
Added to database: 08/25/2026, 10:52:01 UTC
Last updated: 08/25/2026, 22:01:56 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.