Fake GTA 6 Downloads Deliver Wallet Stealers and Solana Drainers

Researchers have documented two coordinated fraud channels exploiting anticipation around Grand Theft Auto VI: a malware-laced fake game executable that harvests cryptocurrency wallet data, and a sham sales page engineered to drain nearly the entire Solana balance of connected Phantom wallets.

On November 13, Help Net Security reported that Cynet researchers traced a supposed GTA 6 executable, promoted through Google Colab, to a ZIP archive containing WARDEN Stealer. The malware is a full-spectrum credential harvester. It collects saved passwords, browser cookies, Steam and Roblox credentials, and cryptocurrency wallet data from infected machines. Its capability set extends beyond passive theft: it can inject code directly into browsers, replace cryptocurrency addresses that a user copies to the clipboard — redirecting transfers to attacker-controlled addresses — and download additional malicious payloads.

The social engineering is deliberately aggressive. The archive's README instructs victims to run the executable as an administrator and to bypass the security warnings that Windows and antivirus tools raise during installation. That instruction doubles as a filter: users who comply have already disabled the protections designed to catch the payload. The file itself contains no game assets and carries no Rockstar signatures, which means a basic authenticity check would expose the fraud before execution.

How the Solana drainer works

The second channel, analyzed by SafeBrowz, operates on the domain latestgta6.com. The site advertised a supposed leaked copy of the game for $50 or 1 SOL — a price point chosen to look incidental. The Solana payment flow is not what it appears.

• A user connecting a Phantom wallet triggers a balance check.
• The page's code reserves 0.005 SOL for transaction fees.
• It then constructs a transfer request for the remaining balance to a fixed attacker address.

A wallet holding 25 SOL would therefore be asked to sign a transfer of 24.995 SOL, not the advertised 1 SOL. The discrepancy sits in the transaction preview, and it is the only place a careful user can catch it.

What does this change for practitioners?

The operational lesson is about where the controls sit. On the malware side, the attack defeats endpoint protections by instructing the victim to disable them — so detection responsibility shifts to pre-execution hygiene: signature verification, hash checks, and refusing unsigned binaries that claim to be major commercial releases. A genuine Rockstar title does not ship through Google Colab.

On the drainer side, the transaction still requires explicit user approval and a signature. Simply visiting the page transfers nothing. But once a Solana transfer is signed, it cannot be reversed — there is no chargeback, no support desk, no recovery window. The single practical defense is reading the amount and destination in the wallet prompt before signing, every time, particularly when the promised price and the requested amount diverge by orders of magnitude. A 1 SOL purchase that requests 24.995 SOL is not a rounding error; it is the entire attack.

Both channels share one structural feature: they monetize scarcity of an unreleased product. No legitimate copy of GTA 6 exists, so every download offer and every "leak" sale is fraudulent by definition. That gives security teams a simple triage rule for user education — any asset tied to an unreleased title should be treated as hostile until proven otherwise, and clipboard-hijacking malware means even address verification should happen after paste, not before copy.