It used to take a studio to fake Rockstar. Now it takes an afternoon.
Grand Theft Auto VI is weeks away, and the fakes got there first. Sites that copy Rockstar's art, dates and layout are selling early access that doesn't exist and handing out "installers" that steal passwords. Here's what's real, what's going around, and what to do if someone in your house already clicked.
Photo via StockSnap (CC0)
What's real
Rockstar's own facts are short. Grand Theft Auto VI launches November 19, 2026, on PlayStation 5 and Xbox Series X|S. Pre-orders opened June 25. People who pre-order a digital copy can start pre-loading on November 12. The boxed version holds a download code, not a disc.
That's the whole list. Rockstar has not announced a PC version or a demo, and there is no beta or early access build. As Malwarebytes puts it, Rockstar is selling pre-orders, not early access. Anything that lets you play before November 19, or play on a PC, is not from Rockstar.
Three fakes going around now
1. "Early access" for a few hundred dollars in crypto. In June, Malwarebytes found sites selling "VIP" early access. The one it examined charged $250 and took only Bitcoin, USDT or Ethereum. You pay and get nothing, and a crypto payment generally can't be reversed.
2. A fake demo that copies what your browser remembers. Rockstar premiered a real Extended Look at GTA 6 on Netflix on August 27. Malwarebytes found fake sites that copied that promo and added a "Play Now" button. The button delivered a file called gta6_installer.exe. At 1.1 MB, it was far too small to be a game. It was Vidar, an infostealer: a program built to copy saved passwords, cookies, autofill data and logged-in sessions out of a browser. It targeted 19 browsers, including Chrome, Edge and Firefox, and showed no window at all.
The sessions are the part that matters. Malwarebytes notes that, depending on the service, a stolen session can let someone into an account without your password or your two-factor code.
3. A "leaked copy" that wipes the computer or empties a wallet. Huntress found fake leaked-copy ISO files, single files that act like a game disc. TechRadar reports they spread through search results, forums, torrent sites and social media, some padded past 100 GB to look real. Inside were remote access tools (programs that let a stranger control the computer, log keystrokes and use the camera), an infostealer that takes Discord tokens, Chrome passwords and Roblox and Minecraft sessions, and a Chaos ransomware variant used as a wiper. It encrypts or overwrites files and deletes backups. There is no ransom to pay. The files are just gone.
In September, Malwarebytes found another "leaked copy" site dressed as a fan countdown page, selling the game for $50 or 1 SOL. Its crypto option loads a wallet drainer: code built to move everything in a connected wallet once you approve, not just the price.
Why the fakes look real now
Attackers used to make mistakes. That's how you knew.
The early access page Malwarebytes examined used AI-generated images next to GTA artwork. Around the August leaks, AI-generated and recycled footage was passed off on social media as fresh leaks. The fake demo sites didn't need to invent anything. They copied Rockstar's real promo and changed one button.
Allure Security lists the rest of the set: fake Rockstar Social Club login pages that collect usernames and passwords, fake GTA 6 mobile apps on third-party app stores for a game that is console-only, and accounts on YouTube, TikTok and Discord that pose as Rockstar or claim insider access and send people to all of the above.
"They're in the honeymoon phase of AI. Everyone's having fun with these tools. The same tools are being used by industrial-scale scammers against US citizens."
Julian M.
One install, the whole family's logins
Picture where these downloads land: the family PC. A teenager installs the game. A parent is still signed in to email, banking and shopping in the same browser.
An infostealer doesn't care whose game it was. It takes what the browser holds: saved passwords, logged-in sessions, the names, addresses and details in autofill. On a shared computer, that's everyone's. The Vidar sample also went after Thunderbird email profiles and the browser inside Roblox Studio.
Then stolen data becomes raw material. A logged-in email account can reset the passwords to everything else. A taken social account can message family and friends in a voice they already trust. Here's how social media takeover works and what protection can and can't do. Saved names and addresses make the next message sound like it came from someone who knows you.
"For my house I have insurance and a camera-based security system. With AI where it's at, people need AI Protection for everything else in their lives."
Julian M.
How AI Protection helps
To be plain: AI Protection doesn't scan your computer, and it doesn't detect or block malware. Keep your computer's own security software on and updated.
AI Protection watches the places your identity shows up when someone uses it. Members are enrolled in Social Security number, dark web, change-of-address, breach, neighborhood watch, and financial account alerts. If details from an infected PC turn up on the dark web, a dark web alert tells you, so you know which accounts to lock down first. Read what dark web monitoring does and what it doesn't.
Three plans, based on how many people you're protecting. The Family plan is $210 a year for up to 4 people. If someone steals your identity anyway, you're covered for up to $5M.¹
"This insurance is peace of mind."
Julian M.
If someone already ran a fake installer
Assume every account used on that computer is now known to someone else. Then, in this order:
- Disconnect the computer from the internet.
- On a different, clean device, change passwords. Start with email, then banking and payment accounts, then shopping, gaming and social accounts.
- Sign out of all sessions. Look for "sign out everywhere," "log out of all devices" or "active sessions." A new password alone may not end a stolen session.
- Turn on two-factor authentication anywhere it isn't on yet.
- Reinstall or reimage the computer, which means wiping it and starting clean, before anyone signs in on it again.
Frequently asked questions
Is GTA 6 early access real?
No. Rockstar is selling pre-orders for a November 19, 2026 launch on PlayStation 5 and Xbox Series X|S. Digital pre-orders can pre-load from November 12 so people can play at launch. Any site selling early access, VIP access or a beta is not Rockstar.
Is there a GTA 6 PC download?
No. Rockstar has not announced a PC version. A "GTA 6 PC download," demo or leaked ISO is a fake, and researchers have found them carrying password stealers, remote access tools and a wiper.
What do I do if I ran a fake installer?
Disconnect the computer from the internet. On a clean device, change your passwords, starting with email. Sign out of all sessions, turn on two-factor authentication and reimage the computer before using it again.
See what AI can find about you
The lure will change after November 19. The raw material it was after won't. Our free scan checks more than 200 US data-broker and people-search sites.
¹ Identity theft insurance coverage is provided under a master policy issued by insurance company subsidiaries or affiliates of American International Group, Inc. (AIG) to Identity and Credit Services. Coverage requires reporting stolen identity events within 90 days of discovery.