How Attackers are Capitalizing on the Hype Around the 'Grand Theft Auto VI' Release
One of the most anticipated video games of all time, “Grand Theft Auto VI,” is only weeks away from release after years of hype and speculation. It’s largely expected to be one of the largest entertainment launches of all time.
Before players can legitimately start the game on Nov. 19, attackers are trying to turn anticipation into downloads, payments, and harvesting personal information. Netcraft reviewed GTA VI-themed domains first seen between July 1 and Oct. 27, 2026. The lures we’re seeing largely fall into four recurring groups: fake downloads using the name of popular GTA VI leaker CyberLeek, false early access, nonexistent mobile versions, and offers to get the game for free.
Some of these malicious sites point to a malicious file or a payment request, while others use a content locker, dangling the alleged download or code that only “unlocks” after the visitor completes surveys, which are offers that appear designed to generate affiliate revenue for the site operator. Unless noted otherwise, Netcraft reviewed what each page displayed and requested but did not pay, complete offers, or connect a cryptocurrency wallet. The status of these sites can also change quickly. An observed wallet prompt, for example, is evidence of a risky lure but not proof that the site drains wallets.
“Want to play the leaked build?”
The first lure borrows the name of CyberLeek, the unidentified person or group that began publishing apparent GTA VI gameplay clips on Aug. 18. Public reporting indicates that CyberLeek had access to at least part of a playable development build. The material released publicly, however, consisted of footage and images, not a downloadable game for players.
Since the first clips appeared, Netcraft has seen 121 newly registered domains containing “cyberleek,” including 100 in August. Not all of these are necessarily fraudulent — that set includes a mix of fan sites, merchandise, and memecoins, but there are sites that use the name to sell or distribute supposed GTA VI builds.
The pattern is straightforward: A page uses CyberLeek in its domain or branding, says the complete game has leaked, and presents the download as safe or verified. The user is then asked to download a launcher or installer, send cryptocurrency to unlock access, or do both.
For example, at gta6cyberleek[.]com, a Rockstar-styled page offered “Grand Theft Auto VI — Download Now For Free” and signed off with “Thanks Cyberleek.” Its download button served a file named GTAVI.exe. At the time of analysis, the sample was detected by 34/68 security engines on VirusTotal, primarily classified as a trojan.
Figure 1: (Left) gta6cyberleek[.]com offered a free GTA VI download. (Right) cyberleek[.]click’s ‘Cyberleek Launcher’ claimed to provide the full game.
A second site, cyberleek[.]click, advertised a “GTA VI Full Leaked Version” through a dedicated launcher and assured visitors there was “no malware or viruses.” At the time of analysis, the launcher was detected by 18/62 security engines on VirusTotal. After the download, the user was told to send $100 USD in cryptocurrency to activate an account and unlock the game. Netcraft observed the payment instructions but did not pay. The domain was parked when rechecked.
Other CyberLeek-themed sites used similar tactics. cyberleek[.]world and cyberleek[.]cfd sold supposed demos or full-game access for cryptocurrency, while cyberleek[.]my offered an “early game build” for 50 Tether or Bitcoin. These sites exploited a real leak story, but their download and payment offers were separate from the publicly released material attributed to CyberLeek.
Figure 2: A CyberLeek-themed checkout on cyberleek[.]my asked users to select a cryptocurrency payment method.
“Want to play before everyone else?”
The second group tries to sell early access, presales, priority downloads, PC copies, and bonus items.
GTA VI can be preordered legitimately, but so far, the game’s developer and publisher have only announced plans to launch the game on the PlayStation and XBOX stores on Nov. 19 — notably no version available for PCs.
Fraudulent sites that Netcraft reviewed instead offered unannounced versions or claimed that users could play before the Nov. 19 launch.
At gta6underground[.]com, a Rockstar-branded “Pre-Release Program” promised priority download, preloading, and a “Vice City Nights” starter pack that came with $500,000 USD worth of in-game currency. The page displayed “Official Partner” and “No Surveys Required” badges. Its “Download Access Application” button claimed to deliver a 2.4 GB file named ‘pre-release-access.exe’. When Netcraft checked, the link redirected to a file that couldn’t be reached, so the payload could not be confirmed.
At gta6[.]exposed, visitors could supposedly buy GTA VI for any platform for $199, including a game key it claimed would work on a PC. The checkout collected an email address and accepted Bitcoin, Monero, Litecoin, or Solana, promising to email an activation key after payment. Netcraft viewed the checkout but did not complete a transaction.
Figure 3: (Left) gta6underground[.]com promoted a pre-release access application. (Right) gta6[.]exposed sold a supposed PC or console key for $199.
Netcraft also saw fake storefronts impersonating the game’s developer, Rockstar, with branded Brazilian “pré-venda” stores with PIX checkout at rockstargamesprevenda[.]store and rockstargamesoficialbr[.]shop, plus a fake preorder at gtavi[.]my that claimed to donate $10 from every order via the charity Gamers For Hope Foundation.
Figure 4: Other preorder lures included a charity-themed page at gtavi[.]my (left) and a Brazilian PIX checkout (right).
These sites do not need to deliver convincing software to make money. A polished preorder page and a familiar payment flow may be enough to persuade a user to pay for a version or access arrangement that the official release does not offer.
“Want to run GTA VI on your phone?”
Rockstar’s announced GTA VI platforms do not include Android or iOS, but search-friendly pages already advertise “GTA 6 APK,” “GTA 6 Mobile,” and Android beta versions. Some provide an actual Android package (APK) file, while others use the promise of a mobile game to send users into content lockers.
One site Netcraft found, gta6thapk[.]com, offered “GTA 6 APK Free Download for Android (Latest Version)” through a “Download Beta Version” button. The file, named “GTA.VI.8.0.9.Beta”, was hosted on GitHub. The page’s installation guide told users to enable installation from an unknown source, which is generally inadvisable.
Netcraft downloaded the APK and checked it with VirusTotal. No security engine detected it as malicious at the time of checking, but it cannot be a legitimate mobile version of GTA VI because no mobile version has been announced. A clean scan at one point in time also does not turn an unvetted, falsely described APK into a legitimate game.
Figure 5: gta6thapk[.]com advertised an Android beta (left) and instructed users to allow installation from an unknown source (right).
Another example, gta6world[.]live, used a different route. Its “GTA VI Access Hub” offered iOS, PC, and Android versions, each behind an “Unlock Access” button. Clicking opened a “Human Verification” popup that asked the user to complete an offer, such as a gift card or sample signup requesting an email address and other personal details. Netcraft viewed the page and popup but did not complete an offer.
Figure 6: gta6world[.]live presented three nonexistent versions (left), then placed access behind a human verification content locker (right).
The same themes appeared elsewhere. Netcraft found near-identical “GTA 6 APK v8.1.5 Beta” sites, including gta6[.]io[.]in, gta6apks[.]in, and gta6mobile[.]com[.]in. gta6mobile[.]app went further, promising ‘GTA 6 Mobile’ for both Android and iOS and urging visitors to ‘install GTA 6 APK and play it on your smartphone or tablet today’. Its download button pointed to an APK hosted on a separate file site. Netcraft also documented a page styled to resemble an app store listing.
Figure 7: Additional GTA VI mobile lures used search-oriented download pages and app-store-style presentation.
“Want GTA VI or GTA$ for free?”
Free game offers use the familiar survey scam bait-and-switch. A site promises a game key, preorder code, giveaway entry, or in-game currency. It asks for a platform or email address, displays counters or simulated activity to create urgency, and then says the user must complete one more verification step. The reward remains out of reach while the user is sent to app installs, signups, or surveys.
One site that falls into this category, mygta6[.]icu, presented an “Official Community Giveaway” and “Game Key Portal” for PlayStation 5, XBOX, and PC. A live activity feed showed masked email addresses supposedly claiming keys, while a counter said “43 of 300” codes remained. After revealing part of a key, the site put the rest behind a content locker, demanding the user ‘pass human verification’ by completing at least two offers from a list of gift card prize draws, surveys and product tests.
Another site, gta6keycodes[.]com, offered “FREE Pre-Order Codes” for PlayStation 5 or XBOX, along with “3,490 active users” and “126 redeem codes left today.” Like mygta6[.]icu, it teased a partial code, then sent users to a content locker, with a 15-minute countdown to complete offers such as an app download or survey sign-up.
Figure 8: Giveaway pages at mygta6[.]icu (left) and gta6keycodes[.]com (right) used counters and code generators before a content locker step.
Rockstar has not announced an online mode for GTA VI or explained whether GTA Online currency or items will carry over. gta6bonuses[.]com offered GTA$ tiers from GTA$250,000 to GTA$10 million. GTA$ is Grand Theft Auto Online’s in-game currency. GTA Online is the multiplayer service associated with Grand Theft Auto V. There have been no announcements yet regarding how the online mode will transfer to GTA VI.
After a simulated account verification step, the site asked the user to complete an offer. Domains such as gta6sharkcard[.]com and gta6bestmoneyglitch[.]com were registered but parked when checked, potential lures to monitor rather than active malicious sites.
Figure 9: gta6bonuses[.]com offered large GTA$ rewards before sending users to an offer.
How to recognize current lures
The clearest check for potential targets is to compare an offer with the announced release. Until the Nov. 19 launch, there is no legitimate playable public release or early-access build of GTA VI. Official preorders may allow preloading before launch. Rockstar has announced GTA VI for PlayStation 5 and Xbox Series X|S on Nov. 19, 2026; it has not announced a PC or mobile version.
Users should treat sites as suspicious when they ask them to sideload an APK, download a launcher from an unrelated domain, send cryptocurrency to activate a game, complete offers to reveal a code, or connect a wallet to claim a GTA-themed token. Purchases should only be made through legitimate retailers like the official PlayStation and XBOX stores.
What we expect after the Nov. 19 launch
Netcraft assesses that the lure mix is likely to shift after launch from “get the game” to “get ahead in the game.” The basis for that assessment is already visible in registered domains and live pages centered on GTA$, bonuses, money glitches, hacks, and free in-game items.
Free GTA$ and offers for “Shark Cards” — bundles of GTA$ bought with real money in GTA Online — are likely to expand. Some will continue using content lockers, while others could ask for Rockstar, PlayStation, or XBOX credentials under the guise of applying a bonus. A lure could directly phish Rockstar, Microsoft, or Sony account credentials. Reused passwords could expose other accounts, while access to an account with a saved payment method could enable unauthorized purchases.
Fake support is another potential route. Netcraft found lookalike domains including contact-rockstargames[.]com, rockstargamessupport[.]com, and rockstargames[.]support, although none served content when checked. Cheats, mods, and “mod menus” are also likely themes because cracked games and game enhancements have been used in the past to distribute malware.
One domain illustrates the value of watching registrations before content appears. gta6jasonlucia[.]com, named for GTA VI’s two main characters, was registered on Sept. 26 and served no content when checked. It resolved to the same shared-hosting IP address as cyberleeks[.]com[.]br and other CyberLeek-themed domains in Netcraft’s observations. Shared hosting makes that link circumstantial, so the domain should be treated as a potential threat to monitor, not evidence of common ownership.
The game’s launch will remove one pretext — the promise of playing before everyone else — but it will create a larger pool of believable rewards, fixes, cheats, and account services. The observed registrations and early pages themed around GTA$ suggest that some operators may be preparing for that chang.
