Fake GTA VI PC download delivers WARDEN Stealer
A fraudulent download advertised as a Grand Theft Auto VI executable is being used to install WARDEN Stealer, according to researchers at Cynet. The malware is designed to collect saved passwords, browser cookies, Steam and Roblox credentials, and cryptocurrency wallet data from an infected computer.
The campaign targets people looking for early access or a leaked PC build. That timing matters: as of November 13, 2026, Grand Theft Auto VI is scheduled to launch on November 19, and there is no PC version. A site offering a PC installer is therefore not distributing the game. The lure uses the expectation of an unofficial download to persuade people to retrieve and run an executable.
Download page presents signs of legitimacy
Cynet traced a link promoted in a Google Colab notebook to a page called “Windows Software Hub.” The page displayed a version number, a download count, and badges labeling the file “Virus Free,” “Secure,” and “Verified.” It advertised a 72 MB download. The researchers found a ZIP archive containing a 796 KB executable and a 1 KB README.
The difference between the advertised download size and the executable size does not, on its own, establish that a file is malicious: a download page and a file manager may report different objects or sizes. The README, however, contains more direct warning signs. It instructs the user to run the executable as administrator, bypass a security warning, and add an antivirus exclusion if the file is blocked. Those directions ask users to weaken protections before running an unverified program.
Cynet reported that the executable contains no game engine or game assets and lacks Rockstar signatures. That is inconsistent with the claim that the file is a playable GTA VI installer. The company identified the malware loader as WARDEN Stealer.
Credential theft and clipboard tampering
Once running, the malware can take credentials and other sensitive information from the affected system. The listed targets include passwords saved in browsers, browser cookies, Steam and Roblox account credentials, and cryptocurrency wallet data. Stealing cookies can expose active web sessions, while stolen passwords may put accounts at risk if they are reused elsewhere.
The sample also checks whether it is running in a virtual machine or sandbox, injects code into browser processes, and can download additional malware. These capabilities increase the risk beyond the initial theft: the first executable may act as an entry point for further malicious activity. Cynet also found clipboard manipulation that replaces cryptocurrency addresses copied by the user. A transfer can consequently be redirected if a victim copies a wallet address and does not verify the address shown at the point of payment.
These functions make the fake-game lure relevant to both individual users and organizations. A personal gaming account or wallet may be the immediate target, but a compromised computer can also contain work credentials, browser sessions, or access to business services. The source material does not establish that this campaign has compromised enterprise systems, so organizations should treat that as a risk to manage rather than a reported outcome.
Defensive steps for IT teams and users
Security teams can use the incident as a reminder to warn users against downloading unofficial game installers, particularly when a purported installer is paired with instructions to run as administrator or disable endpoint protections. A security warning or a request to create an antivirus exclusion should be treated as a reason to stop and verify the software through an official channel, not as a routine installation hurdle.
Organizations should ensure endpoint protection remains enabled and that users cannot casually add exclusions without appropriate review. If a user has run the file, responders should investigate the endpoint for credential exposure and other malware, contain the system as appropriate, and use established incident-response procedures. Potentially exposed passwords should be changed from a known-clean device, with particular attention to reused credentials and accounts protected by multifactor authentication.
Cynet named uroker[.]casa as the probable command-and-control server used by the stealer to report back. It also published SHA-256 hashes for the executable and README. Defenders can consult those published indicators when building detections or investigating an alert. The researchers listed 104.21.75[.]176 but cautioned against blocking it because it is a shared Cloudflare IP address. Blocking a shared address could affect legitimate services; defenders should not treat it as a dedicated malicious host.
The core lesson is straightforward: a polished download page and reassuring badges do not authenticate an installer. In this case, the absence of an official PC release, the README’s request to bypass protections, and the executable’s lack of game content provide strong reasons not to run the file.
