- NordVPN’s threat intelligence team identified hundreds of fake GTA 6 pre-order sites, repacks and Android apps deploying DLL-sideloading trojans and infostealer malware.
- The malware infrastructure powering the campaign overlaps with families that capture browser credentials and private keys used to access cryptocurrency wallets.
- Marijus Briedis, chief technology officer at NordVPN, said attackers are exploiting fan impatience.
NordVPN’s threat intelligence team recently disclosed a coordinated scam wave exploiting anticipation for Grand Theft Auto VI, with fake pre-order sites, malware-laced game repacks and counterfeit Android apps spreading credential stealers that researchers warn can also drain cryptocurrency wallets.
The campaign spans hundreds of phishing pages mimicking the Rockstar Social Club login, fake “GTA 6 Beta” Android apps that act as empty shells for full-screen ads and malware redirects, and pirated game repacks containing DLL-sideloading trojans disguised as NVIDIA driver components.
“When people are desperate to get early access to something, their guard comes down. That’s the window attackers exploit,” stated Marijus Briedis, chief technology officer at NordVPN.
Read more: NEAR Could Be the “Privacy Rail” Powering Zcash’s Next Boom, Says Arthur Hayes
Infostealer Payload Targets Wallets
The crypto-relevant risk sits in the malware infrastructure behind the campaign rather than any GTA-specific token scam. NordVPN traced one fake-app domain to a host with a documented history of distributing banking trojans, ransomware and information-stealing malware; families that, according to the report, “can capture credentials and private keys used to access cryptocurrency wallets.”
Moreover, NordVPN identified hundreds of fake login pages targeting Rockstar Social Club accounts, frequently hosted on legitimate platforms such as GitHub and Vercel to bypass basic reputation filters.
The credentials harvested through those forms feed underground marketplaces that also broker stolen exchange and wallet logins, giving the same operators a path from a gaming lure into a self-custody compromise.
One malware sample identified on May 17 used a domain that had been registered only 23 days earlier. Fake repacks of FitGirl, DODI and ElAmigos installers were among the carriers, mimicking trusted piracy brands to lower target skepticism.
Crypto Holders Caught In Cross-Lure
Briedis flagged that scammers are deliberately targeting platforms the game has not been confirmed for at launch. Rockstar Games has confirmed Grand Theft Auto VI only for PS5 and Xbox Series consoles at the November 19, 2026 release, yet NordVPN observed campaigns aimed at PC and Android users-
For cryptocurrency holders, the operational takeaway is to treat any pre-launch GTA 6 installer, beta key or “exclusive” download as hostile, and to avoid signing into a Rockstar account from any link served outside the official Rockstar Games and Take-Two channels.
The same infostealer families implicated in the campaign routinely pull seed phrases from browser extension storage, clipboard contents and password managers — the precise attack surface most self-custody users rely on day to day.
Related: Former OpenZeppelin CTO Warns AI Has Made All DeFi Unsafe
