- Cynet found WARDEN Stealer inside a fake GTA 6 executable download.
- The malware targets saved passwords, browser cookies, and crypto wallet data.
- A fake 1 SOL offer was coded to request nearly all of a connected wallet’s balance.
Fake Grand Theft Auto VI downloads are becoming a route into crypto wallets. Researchers have identified malware that steals wallet data from infected computers and a separate fake sales page that asks users to transfer nearly all their Solana.
On November 13, Help Net Security reported that Cynet researchers traced a supposed GTA 6 executable promoted through Google Colab to a ZIP archive containing WARDEN Stealer. The malware collects saved passwords, browser cookies, Steam and Roblox credentials, and cryptocurrency wallet data. It can inject code into browsers, replace copied crypto addresses, and download more malware. Its README instructs users to run it as administrator and bypass security warnings. The file contains no game assets or Rockstar signatures.
Two Ways to Lose Crypto
Meanwhile, SafeBrowz examined latestgta6.com, which advertised a leaked copy for $50 or 1 SOL. Researchers said the Solana button checks a connected Phantom wallet’s balance, reserves 0.005 SOL for fees, and requests the rest be sent to a fixed address. A wallet holding 25 SOL would therefore be asked to transfer 24.995 SOL, not 1 SOL. The transaction still requires user approval and a signature; simply visiting the page does not transfer funds. A signed Solana transfer cannot be reversed.
SafeBrowz also found the same lucifer.v8.js file on 12 other domains; eight still served it on November 13. Shared code suggests reused drainer tooling but does not prove one operator runs all the sites.
Follow us on X for real-time crypto updates.
Fake Leaks Fuel the Lure
These lures exploit searches for leaked builds, PC versions, and early access. Netcraft reviewed GTA 6-themed domains registered between July 1 and October 27, identifying fake leaks, mobile versions, free downloads, and advance sales. One fake Rockstar page offered GTAVI.exe, which 34 of 68 VirusTotal engines flagged, mostly as a Trojan. Other sites demanded cryptocurrency for access that does not exist.
Rockstar announced GTA VI for PlayStation 5 and Xbox Series X|S on November 19, with no PC version or early-access build announced. The absence of a PC release makes any GTA 6 installer advertised online especially suspect.
Stop Before You Sign
Buy only through official console stores, and avoid leaked installers, APKs, crypto checkout links, and wallet-connection prompts. Never disable antivirus protection or run unknown files as administrator. Check each wallet request’s recipient, token permissions, and exact amount; reject transactions that sweep most of the balance or grant unfamiliar permissions.
If an installer was run, scan the device and change saved passwords from a clean device. Review wallet activity and revoke unfamiliar token approvals. If a recovery phrase was entered, treat the wallet as compromised and move remaining funds to a newly created wallet on a clean device.
Subscribe to our YouTube channel for the latest crypto news.
Related: GTA 6 Could Cost the US Economy $1 Billion in One Day — But Who Really Loses?
Please note, this site provides content for entertainment purposes only and does not offer financial advice. Read more here