Fake GTA 6 'Demo' Sites Deploy Vidar Malware to Target Fans

Cybercriminals are targeting Grand Theft Auto 6 fans with fraudulent websites that mimic Rockstar Games' branding to distribute infostealer malware. The campaign tricks users into downloading a file presented as an official game demo or advance build, which instead installs malicious software on the victim's system.

The surge in these fraudulent sites followed the release of an official "Extended Look" trailer for the game, which premiered on August 27, 2026, via Netflix. According to security reports from Malwarebytes and Engadget, the malware is an infostealer—specifically identified by some sources as Vidar—designed to harvest sensitive data. The software is capable of accessing stored browser passwords, cookies, authenticated sessions, browsing and download history, autofill data, and FTP client credentials. It can also target cryptocurrency wallets.

The Context of the Scam

This campaign exploits the extreme anticipation for one of the most highly awaited releases in gaming history. While the development of GTA 6 has been plagued by previous leaks involving screenshots and videos, Rockstar Games has confirmed that no playable demo or advance build of the game has ever been legitimately released or leaked. The attackers are simply using the official marketing momentum to create a sense of urgency and legitimacy for their fake portals.

Why It Matters

This attack is particularly dangerous because of how it handles authenticated sessions. By stealing session cookies, attackers can perform "session hijacking," allowing them to enter a user's account without needing a password. This technique effectively bypasses multi-factor authentication (MFA), as the attacker assumes the identity of a user who has already successfully logged in. For a massive, global user base, this opens the door to the compromise of email, financial, and social media accounts.

What's Next

Security researchers continue to monitor the proliferation of these mimic sites as the game's release window approaches. Users are urged to rely exclusively on official Rockstar Games channels for news and downloads. As the campaign evolves, analysts are watching for shifts in the malware's delivery method or the emergence of new variants designed to evade detection by standard antivirus software.