A fraudulent website posing as a source for a leaked PC copy of Grand Theft Auto VI is draining cryptocurrency wallets from visitors who connect them, according to cybersecurity firm Malwarebytes. The site, flagged at latestgta6[.]com, loads wallet-draining code the moment a user arrives on the page.
Malwarebytes published its findings on September 1, 2026. The campaign represents the latest in a series of scams exploiting anticipation for Rockstar Games’ upcoming title.
A Convincing Disguise
The page mimics a legitimate GTA 6 fan countdown site. It displays a live timer to the game’s November 19, 2026 release date, a map of Leonida, and a grid of release facts matching Rockstar’s official announcements.
The page correctly states that GTA 6 is scheduled for PlayStation 5 and Xbox Series X|S, and that Rockstar has not announced a PC version. That accurate information surrounds two fraudulent offers.
One offer sells a supposed leaked copy of the game for $50. The other offers the same content for 1 SOL, worth approximately $102 at the time of the report. To complete either purchase, a user must connect a cryptocurrency wallet to the domain.
The site also warns visitors that every other page offering leaked material is a scam, presenting itself as the only safe option. Malwarebytes described this as a common technique to reassure users who are already suspicious.
Despite the effort to appear legitimate, the page contains numerous errors. Its footer claims the site offers no purchase, download, or payment of any kind, directly beneath two payment buttons. The FAQ promises a PC download after purchase while another section acknowledges the game is console-only. The sales copy contains a misspelled ‘DOWNLOAD’ and references GTA IV instead of GTA VI.
Malwarebytes assessed that a legitimate-looking fan template was likely reused and the fraudulent sales pitch was added by someone who did not proofread it.
How the Wallet Drainer Works
The malicious code appears in two separate components. The first is embedded directly into the page and targets Solana wallets.
This code does not charge the advertised $50 or 1 SOL price. Instead, it checks the connected wallet’s balance, leaves a small amount to cover the transaction fee, and prepares to transfer everything else to the attacker. The advertised price plays no part in the calculation.
Malwarebytes said the code leaves about 0.005 SOL in the victim’s account, approximately 50 cents in US dollars. That behavior makes the requested purchase price a lure rather than a limit on potential loss.
The second component is a separate script of roughly 2.4 MB. It includes a legitimate, widely used tool for connecting websites to cryptocurrency wallets, with malicious code added on top.
This larger script inventories the connected wallet, calculates what its assets are worth, reports the details to the attacker, and retrieves transactions for the victim to approve. It is configured to target wallets across seven blockchain networks.
Networks and Assets Targeted
The drainer targets Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base, and Fantom. It can identify major stablecoins on those networks and request several kinds of access.
Malwarebytes stressed that simply connecting a wallet does not allow the site to take anything. The danger arises when a user approves the transaction or permission request that follows.
A transfer moves assets immediately. A token or NFT approval can give the attacker access to those assets later. The script supports both types of requests, depending on what the victim approves.
The report noted that the signing screen, not the marketing page, is the decisive security checkpoint.
Signs of Rented Infrastructure
Malwarebytes found that the larger script downloads an operator identifier and settings from a remote server. Its destination address also differs from the Solana address embedded in the page.
The researchers said this structure resembles a hosted service used by multiple customers, though they could not identify a specific product. Remote configuration would let an operator change where stolen funds are sent without editing the fake GTA 6 page itself.
The code also profiles wallets before seeking approval and includes measures intended to frustrate automated scanners and browser developer tools. An optional country filter blocks visitors from ten countries in the Commonwealth of Independent States region, including Armenia, Azerbaijan, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Russia, Tajikistan, Turkmenistan, and Uzbekistan.
Malwarebytes cautioned that the country filter alone does not establish who built or operates the campaign.
A Pattern of GTA 6 Scams
Malwarebytes has identified three distinct waves of GTA 6-themed scams in 2026. In June, the firm analyzed sites selling GTA 6 ‘early access’ for hundreds of dollars in cryptocurrency. Victims paid, received nothing, and could not reverse the payments.
In August, Malwarebytes uncovered fake Extended Look and demo websites delivering an information-stealing program instead of a game. ThaiCERT also reported a 113 GB fake game file circulating in August that contained only about 50 KB of actual malicious code, with empty data padding the rest to appear legitimate.
The latest campaign combines accurate game information with fabricated transaction processes to lower user vigilance. U.Today reported that on-chain analytics firms tracked a wallet associated with CYBERLEEK transferring approximately $350,000 in a separate but related wave of crypto activity.
Malwarebytes said that any page requiring upfront payment, downloading, or connecting a wallet to claim exclusive content is a high-risk scenario.
Safety Guidance
Malwarebytes advised users to reject requests that move nearly an entire balance or grant a game seller control over tokens or NFTs. Users should only use trusted download sources and separate valuable holdings from wallets used for unfamiliar applications.
Anyone who approved access to the fraudulent site should review and revoke active permissions. A user who entered a recovery phrase should treat the wallet as compromised and move remaining assets to a new wallet.
Experts recommend avoiding game file downloads from torrent sites or untrusted websites, refraining from opening installers from unofficial sources, and verifying information only through Rockstar’s official channels.
Rockstar Games has not issued a public statement about the fraudulent website. The company has also not commented on the broader wave of GTA 6-themed scams.
Grand Theft Auto VI is scheduled to launch on November 19, 2026, for PlayStation 5 and Xbox Series X|S. No PC version has been officially announced.