The Installer Who Offers to Set Up a Game That Isn't Out Yet — GTA 6

The doorbell rings. You open the door and there’s a box as tall as a person. A technician in work clothes says, “I’m here to install what you ordered.” You don’t remember ordering anything, but it’s something you’ve wanted. So you let them in.

The technician rustles around in the middle of the living room for a good while. They explain something in words that are hard to follow, and then finish with this: “Sorry, the product activation isn’t going through. Can’t install it today.” Then they leave the box behind and go. You open the box and it’s almost all styrofoam inside.

“Oh well, it didn’t work.” It would be nice if the story ended here, but the real story begins after the technician leaves. In those few minutes the technician was in the living room, your house key was copied, a small camera was mounted on the ceiling, and the photos in your album were swapped out for different paper.

The case a security firm analyzed and published this week has exactly the same structure as this scene. There’s only one difference. The thing that technician offered to install was a game that hasn’t even been released yet.

---

First, What Happens on My End

Someone waiting for GTA 6 types “leaked build” or “early play” into a search bar. A link shows up near the top of the search results or in a gaming community post. Click it and you download an image file over 100GB. An image file is a large file that’s a copy of an entire disk. It’s a size that takes all night to download.

Once it’s downloaded and opened, there’s an installer inside. You run it. A prompt in Russian appears. Get through a few steps and at the end an error says “license not found” and it stops. The game doesn’t launch. “The crack doesn’t work,” you think, and close the window.

FACT According to the analysis firm Huntress, that error window isn’t a sign of failure. While the user assumes the installation didn’t work, the malware has already finished installing. It’s like the copy of the key that’s left behind after the technician says “not today” and walks out.

FACT Four kinds get installed at once. The remote-access trojans NJRAT (multiple copies) and DCRAT, the information stealer Mercurial Grabber, and Chaos ransomware used for destructive purposes. As a bonus, a Yandex Browser the user never installed appears too. A trojan is the term for a program that comes in pretending to be useful and does something else once inside.

FACT Boannews summarized what a remote-access trojan can do. Recording keystrokes, turning on the webcam, capturing the screen, intercepting copied and pasted content, and remotely controlling the PC. This is the camera mounted on the ceiling. It’s as if someone is sitting next to you watching you type.

FACT The information stealer picks what it takes. Passwords saved in the browser, Discord tokens, cryptocurrency wallet information, screenshots, the Windows product key, and Minecraft session information. A Discord token is like a pass that gets straight into your account without a password. This is the copied house key.

FACT And then the ransomware. Ransomware is usually a program that locks files and demands money. But this case is different. Files smaller than 200MB are encrypted, and files larger than that are overwritten with random data. Overwritten files don’t come back even if you pay. There’s no mechanism to return them in the first place. That’s why the analysis firm calls this effectively destructive — a wiper. The photos in the album swapped for different paper — that’s this part.

FACT If it was run with administrator privileges, one more step is added. Before destroying files, it deletes Windows shadow copies and disables recovery. Shadow copies are file copies Windows quietly keeps in case something goes wrong. Administrator privileges are the master key among house keys, the one that opens every room. If you handed that over, the technician wipes the CCTV recordings on the way out too.

Why It Works — Because I’m the One Opening the Door

FACT There’s no vulnerability in this technique. There’s not a single CVE number in the brief. A CVE is a number assigned to a known security hole in software. Nobody broke in through a hole. I downloaded it, and I ran it. The technician didn’t break down the door; I opened it.

FACT Size dulls suspicion. The file exceeds 100GB, but most of it is junk data stuffed in to make it look like a real blockbuster game. The actual malicious part is much smaller. That’s why the box is as tall as a person and full of styrofoam.

INFERRED The fact that you spent all night downloading it becomes a trap in itself. The more time you invest, the stronger the feeling that “this can’t be fake.” It’s hard to download the whole thing and then not run it. Size isn’t proof of authenticity; it’s just a number.

INFERRED The error window also looks calculated. If a window said the installation succeeded, the person would try to launch the game, and if it didn’t launch, they’d sense something was off. But if it says “no license” from the start, they convince themselves: “the crack just doesn’t work.” There’s no one to get angry at, either. Nobody reports a technician who failed to install something.

FACT And the most important fact. There is no official demo. There’s no sign that a real leaked, playable copy is circulating online either. A technician who offers to bring an unreleased product to your home and install it is fake on that fact alone.

The Size in Numbers

Only four numbers are confirmed in this case. The number of victims appears nowhere. Please read the third column along with the rest. Confirmed facts and items that exist only in press reports are mixed together.

FACT 100GB is a size that takes up a big chunk of the storage on most laptops. Yet most of that weight is styrofoam. Size has nothing to do with authenticity.

FACT 4 kinds means “just block one” doesn’t work. Remote control, password theft, and file destruction all start at the same time. Take back the key and the camera is still there; remove the camera and the album has already been swapped.

FACT 200MB is a lower threshold than it sounds. A single video shot on a smartphone, a game save file, or a bundle of photo backups mostly cross that line. The moment they cross it, they aren’t locked — they’re destroyed.

INFERRED The 0 is this post’s conclusion. Not a single real one exists, yet “leaked builds” keep circulating. So there’s no need to calculate what the “leaked builds” currently circulating actually are.

FACT The last row of the table is separate from this case. Dailysecu reported that in August, Kaspersky reported a 113GB fake GTA 6 leaked build. That’s a different file from the Huntress analysis covered in this post. All we can say here is that the same bait keeps circulating, carrying different malware each time.

So, What to Do Now

What to do splits into before downloading and after downloading.

One. Do not download “leaked build / demo / early play” files circulating before release.

This doesn’t require judgment. The number of confirmed real ones is 0. So the moment something carries the name “leaked build,” it’s fake. It doesn’t matter if it’s at the very top of the search results, if several people in a community recommend it, or if it’s over 100GB. A technician who offers to install something that hasn’t even come out yet can simply be turned away at the door.

Two. If you’ve already run it, do these in order.

First, disconnect that PC from the internet. Unplug the LAN cable or turn off Wi-Fi. Remote control needs an internet connection to continue.

Next, change your passwords from a different device. Passwords saved in the browser, Discord, and game accounts come first. Do not change them on the infected PC. That would be typing your new password in front of a program that’s watching your keystrokes.

Turn on two-factor authentication for every account whose password you changed. Two-factor authentication is a mechanism that requires one more confirmation step besides the password, such as your phone. Even if the key was copied, a second lock means the door doesn’t open right away.

Finally, reset the PC. The analysis firm’s recommendation is a full reinstall. Finding and removing four kinds one by one on a PC where they were installed all at once isn’t realistic.

FACT If you see these signs, you should assume you’ve already run it. A Russian-language prompt appeared during installation. After installation, only a “no license” error appeared and the game didn’t launch. A Yandex Browser you never installed appeared. Large files like photos or videos suddenly won’t open.

FACT Help Net Security reported that an up-to-date Windows Defender can detect this malware. This point exists only in press reports.

INFERRED So downloading it on the assumption that “Defender will catch it” gets the order wrong. Antivirus is a mechanism for catching a technician who’s already inside the door, not a permit that says it’s fine to open the door. The first thing to do — not downloading — is still everything.

What We Don’t Know

This blog does not write unconfirmed things as if they were confirmed. Here is what we still don’t know in this case.

• We don’t know whether there are victims in Korea. No report contains domestic victim cases or a victim count. That’s why this post does not state the scale of damage.
• We don’t know who made it. Because of the Russian-language prompt and the Yandex Browser, the possibility that it targeted Russian-speaking users has merely been raised. Neither the group nor the nationality has been confirmed. This post does not identify the perpetrator.
• We did not confirm GTA 6’s exact release date in this post. Help Net Security wrote only that release is about three months away.
• We don’t know whether Macs or smartphones face the same risk. What was analyzed is only an executable for Windows PCs. There’s no basis for saying the same applies to other devices.
• We could not confirm whether this file is actually circulating in Korean communities or torrents. The distribution channels are relayed from what Huntress observed.

Sources

Primary sources listed first.

• Huntress, “Grand Theft Auto VI hype leads to malware” (2026-09-09) — https://www.huntress.com/blog/fake-gta6-download-malware-analysis
• Help Net Security, “Fake GTA 6 download delivers malware-packed bundle to impatient gamers” (2026-09-10) — https://www.helpnetsecurity.com/2026/09/10/fake-gta-6-downloads-malware-ransomware/
• Boannews, “Attack discovered that infects with 4 types of malware at once using GTA 6 leak as bait” (2026-09-11) — https://www.boannews.com/news/articleView.html?idxno=145794
• TheElec, “Trojan malware disguised as the game ‘GTA 6’ spreading globally” (publication date unconfirmed) — https://www.thelec.kr/news/articleView.html?idxno=57822
• Dailysecu, report on Kaspersky’s August finding (113GB fake leaked build) — https://www.dailysecu.com/news/articleView.html?idxno=208184

---

This post is written from others’ reporting, not from our honeypot observations. That’s why there are no attack timeline, MITRE, or IOC blocks — we do not fabricate material that doesn’t exist. Figures are taken only from the primary analysis (Huntress, 2026-09-09), and content that exists only in press reports and not in the primary source (Windows Defender detection, the August 113GB case) is marked in the body as “reported.” The perpetrator’s nationality and affiliation and the scale of domestic damage have not been confirmed, so they are not stated in this post. We do not include reproducible commands, malicious addresses, or installation procedures. Malware names are relayed only as disclosed in the primary source. Brief date and publication date 2026-09-15.