GTA 6 arrives on November 19, and scammers already exploit the hype. A new campaign promises a free PC version of the game and delivers an infostealer that empties browser data, game accounts, and crypto wallets. Rockstar has not announced a PC release, so every PC download you see right now is fake.
Is There a GTA 6 PC Version?
No. Rockstar confirmed only PlayStation 5, Xbox Series X, and Xbox Series S for launch. Millions of players want the game on day one, and many of them use PCs. That gap gives criminals a simple pitch: "the PC version you cannot find anywhere else." Players who search for leaks or early builds walk straight into the trap.
How the Fake GTA 6 PC Download Scam Works
Security researchers traced the campaign to a Google Colab notebook. The notebook carries a link labeled "GTA 6 EXE FILE DOWNLOAD." Clicking it sends you to a page called "Windows Software Hub," which runs on a WooCommerce site.
The page tries hard to look trustworthy. It shows a version number, a download counter, and badges that read "Virus-free," "Secure," and "Verified." It even prints a "0 threats detected" message. None of those claims come from a real scan.
Image via Cynet
Red Flags of a Fake Game Installer
The download itself gives the scam away in three ways:
- The page advertises a 72 MB file. Modern AAA games weigh tens or hundreds of gigabytes, and the GTA 6 preload tops 200 GB.
- The ZIP archive actually holds a 796 KB executable and a 1 KB README file.
- The README tells you to run the program as administrator, ignore security warnings, and add an antivirus exclusion if your system blocks it.
That last step matters most. Real games never ask you to switch off your protection. Criminals ask because security software already flags the file.
What WARDEN Stealer Steals From Your PC
The executable contains no game engine, no game assets, and no Rockstar code. It installs WARDEN Stealer, a loader for information-stealing malware. Once it runs, it:
- Checks for sandboxes and virtual machines so analysts struggle to study it
- Injects malicious code into your browser processes
- Steals saved passwords, cookies, and browsing data
- Takes browser extension secrets, which can include wallet extension keys
- Grabs Steam and Roblox login details
- Collects cryptocurrency wallet data
- Swaps any crypto address you copy with the attacker's address
- Downloads additional malware on command
The clipboard trick deserves extra attention. You copy a wallet address, paste it into your exchange, and send funds. The pasted address now belongs to the attacker, and crypto transfers cannot be reversed. Strong crypto wallet security habits limit the damage.
Indicators of Compromise: Domain, Hashes and IP
Researchers flagged uroker[.]casa as the likely command-and-control server, the machine the stealer reports back to. They also published SHA-256 hashes for the executable and the README. The sample touches the IP address 104.21.75[.]176 too, but network teams should not block it, because it is a shared Cloudflare address and blocking it would cut off many harmless sites.
Other Fake GTA 6 Downloads Seen Before Launch
Criminals have used the game as bait for months, and they change tactics each time:
- In August, a 113 GB ISO spread on torrent sites and claimed to be a leaked playable build. Almost all of it was zero-filled junk, and the real payload was a tiny 50 KB virus that added Windows Defender exclusions and killed security tools.
- Also in August, fake Rockstar-style sites distributed the Vidar infostealer.
- In September, a fake countdown site hid a wallet drainer built to empty crypto wallets.
- A domain study found 121 new domains using "CyberLeek" and other GTA 6 terms between July and October, and 100 of them appeared in August. Of 68 antivirus engines on VirusTotal, 34 detected an executable from those sites.
The delivery method changes, but the bait stays the same: fan impatience. Other fake software downloads follow the same pattern with cryptojacking malware.
How to Stay Safe From Fake GTA 6 Downloads
- Treat any GTA 6 PC download as malware until Rockstar announces an official PC version.
- Buy the game only from the PlayStation Store or the Xbox Store on launch day, and check the GTA 6 price for your region first.
- Never disable antivirus, add exclusions, or run an unknown file as administrator because a README says so.
- Ignore trust badges on download pages. Anyone can paste them onto a site.
- Be careful with links hosted on shared platforms such as Google Colab, Discord, or file lockers.
- Turn on two-factor authentication for Steam, your email, and your exchange accounts.
- Store large crypto holdings in a hardware wallet, buy it only from the maker because a Ledger implant case shows tampered devices exist, and always check the first and last characters of a pasted address before you send.
What to Do If You Ran the Fake GTA 6 Installer
Disconnect the PC from the internet first. Then use a clean device to change your email, Steam, Roblox, and exchange passwords, and sign out of all active sessions. Move any crypto to a new wallet with a fresh seed phrase, because the old one may be exposed. Finally, run a full scan with a trusted security tool, or better, reinstall Windows, since the loader can pull down extra malware.
Frequently Asked Questions
Is there a GTA 6 PC version?
No. Rockstar has announced GTA 6 only for PS5, Xbox Series X, and Xbox Series S. Any site offering a PC installer right now sells malware, a scam, or both.
When does GTA 6 launch?
GTA 6 launches on November 19 on PlayStation 5, Xbox Series X, and Xbox Series S.
What is WARDEN Stealer?
WARDEN Stealer is a loader for infostealer malware. It steals saved passwords, cookies, Steam and Roblox credentials, and crypto wallet data, and it can download more malicious files.
How can I spot a fake game download?
Compare the file size with the real game, check that the source is an official store, and watch for instructions to disable antivirus. A 796 KB "game" that asks for an antivirus exclusion is never legitimate.
Can antivirus software stop this malware?
Many engines detect it, which is exactly why the README tells victims to add an exclusion. Keep your protection on and the file stays blocked.
Related Guides
- GTA 6 PC Release Date: Is Q1 2027 Real?
- GTA 6 Preload Guide: Start Times, 212GB Size and How to Download on PS5 and Xbox
- GTA 6 Global Prices: How Much It Costs in Every Region
- GTA 6 Pre-Orders Start June 25 as Rockstar Reveals Official Cover Art
- GTA 6 PS5 vs PS5 Pro: Rockstar Confirms 30 FPS, PSSR and Ray-Traced Shadows, and Whether the Pro Is Worth It
