Hackers Use Fake GTA 6 Apps, Phishing to Steal Accounts

NordVPN’s Threat Intelligence team reports that cybercriminals are exploiting interest in Grand Theft Auto 6 by distributing fake applications, cloned piracy sites and phishing pages to spread malware and steal Rockstar Social Club credentials. The activity picked up after rumors suggested pre-orders or early access might open soon.

The campaigns target Windows PCs and Android devices and include websites promising “exclusive beta keys” for PS5 and Xbox Series consoles, despite no confirmed releases for those platforms. Some scam sites ask users to pay for subscriptions in exchange for beta access, while others require downloads that install additional malicious components.

Researchers identified cloned versions of well-known piracy sites offering fake GTA 6 packages for Windows. In one case, a package included a file disguised as an Nvidia graphics driver. Running that file altered a device’s memory, downloaded further malware and allowed attackers to send remote commands.

NordVPN also traced a fake Android app that contains no game. The app displays full-screen ads and directs users to subscription pages or links that prompt additional malware downloads.

The company found hundreds of amateur phishing pages that imitate Rockstar’s login system to harvest Social Club usernames and passwords. Stolen accounts can be resold on underground markets or used to commit in-game fraud, according to the report.

Investigators linked one fake app domain to previous distributions of banking trojans, ransomware and information-stealing malware. Those types of malware can capture credentials and private keys used to access cryptocurrency wallets.

“When people are desperate to get early access to something, their guard comes down,” NordVPN CTO Marijus Briedis warned. “That’s the window attackers exploit.”

NordVPN recommends avoiding unofficial downloads and suspicious sites, checking URLs before entering credentials and enabling two-factor authentication where available. The firm’s findings document how multiple tactics-phishing forms, fake downloads and repackaged installers-are being used to harvest account data and deliver malware as GTA 6 approaches its expected November release.

Rumors that the game will include cryptocurrency features remain unsubstantiated, the report adds.