All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
A fake Grand Theft Auto VI demo is circulating online, but anyone who runs it could hand criminals access to far more than their gaming account.
Researchers at Malwarebytes uncovered a network of websites impersonating Rockstar Games and advertising an “official” GTA 6 download. Instead of a playable demo, their download buttons deliver an information-stealing malware program that can collect passwords, browser cookies, and active login sessions.[1]
Those stolen sessions could allow attackers to access accounts without entering the victim’s password or completing a new two-factor authentication check. That means changing your passwords may not be enough to lock them out.
Fraudulent websites capitalize on intense interest in leaked GTA 6 material and Rockstar’s upcoming extended preview of the game.
Some appeared in Google results for GTA 6 demo searches and copied Rockstar’s artwork and promotional language. According to Malwarebytes, their “Play Now” buttons downloaded a file named gta6_installer.exe.
However, Rockstar has not released or announced a playable GTA 6 demo, beta, PC build, or early-access version.
The company’s official GTA 6 website says its “Extended Look” will premiere on August 27. That is a video presentation, not a downloadable game. GTA 6 itself is scheduled for release on November 19, 2026, for PlayStation 5 and Xbox Series X|S.
The supposed installer offers another clear warning sign: It is only 1.1 MB. That is nowhere near large enough to contain a modern blockbuster game.
The malicious installer contains Vidar, an established family of information-stealing malware.
Once opened, it can quietly search a computer for:
Researchers observed the malware targeting 19 browsers, including Chrome, Edge, Firefox, Brave, Opera, and Vivaldi. It also searched Thunderbird profiles, Perplexity’s Comet browser, and the browser component built into Roblox Studio.
The malware does not display a game, installation window, or obvious error message. To the victim, the fake installer may simply appear to do nothing.
Malwarebytes did not find a mechanism that would automatically restart the malware after the computer rebooted. However, the program does not need to remain installed to keep causing damage. Once criminals steal account credentials and session tokens, they can keep trying to use them.
Websites use session cookies or tokens to remember that you have already signed in. They're why you don't need to re-enter your password every time you open another page.
If a criminal steals a valid session token, they may be able to reuse that authenticated session and enter the corresponding account without signing in normally.
This can also weaken the protection offered by two-factor authentication. Two-factor authentication helps verify a new login, but a stolen session was created after the legitimate user had already passed that check. Depending on the website’s security controls, the attacker may not be asked for either the password or a second authentication factor.
The malware uses legitimate Chrome, Edge, and Firefox programs installed on the computer to access protected browser information. It launches the browsers in a hidden mode and directs them to temporary profile folders, according to Malwarebytes.
Rather than visibly breaking the browser’s encryption, the malware works through software that is already trusted to read browser data.
As Cyber Security News notes, the resulting exposure can extend to email, social media, shopping, payment, and gaming accounts.
If you downloaded and opened a supposed GTA 6 demo, assume that passwords and browser sessions stored on that computer may have been compromised.
Take these steps:
Do not overlook gaming accounts such as Steam or Epic Games. They may contain saved payment methods, digital inventories, personal information, and access to other connected services.
Download games, demos, and updates only from the publisher’s official website or established stores such as Steam, the Epic Games Store, the PlayStation Store, and the Microsoft Store.
A polished website is not proof that a download is legitimate. Criminals can easily copy official artwork, logos, screenshots, and announcements. Malicious websites can also appear in search results or paid advertisements.
Treat supposed leaks, private betas, and early PC builds with particular suspicion. If a publisher has not announced a download through its official channels, clicking “Play Now” could give someone else early access to your accounts instead.
Unfortunately, no legitimate GTA 6 demo or PC installer is available. Gamers will have to wait another couple of days for anything new from Rockstar Games, and websites claiming otherwise may be distributing malware that steals passwords and active browser sessions.
If you ran one of these installers, removing the malware is only the first step. Change important passwords from a clean device, revoke every active session, remove unfamiliar devices, and continue monitoring your accounts for unauthorized activity.
Our #1 rated antivirus that scores 18/18 on AV-TEST across Windows, macOS, and Android, verified across multiple test rounds
Passed every malware, drive-by download, and phishing detection test we ran, quarantining threats automatically
Backed by a 100% Virus Protection Promise: if Norton can't remove a virus, you get your money back
/images/2025/04/16/nordprotect_review.jpg)
/images/2023/05/05/lifelock-review.png)
/images/2026/08/25/chameleon-seo-poisoning-phishing.jpeg)
/images/2026/08/25/fake-gta-6-demo-malware-steals-passwords.jpg)
/images/2026/08/05/fake-irs-crypto-scam.png)
/images/2026/07/30/fake-walmart-websites.jpg)
/images/2026/07/29/apple-app-store-lawsuit.jpg)
/images/2026/07/28/states-highest-cybercrime-youth.png)
/authors/thomas-kent-headshot-cropped.png){kind=small}
/authors/kalleigh-lane-new.jpg){kind=small}
/images/2023/03/03/logo-norton-large.png){kind=logo}
/authors/thomas-kent-headshot-cropped.png)