Fake GTA VI Sites Deploy Stealer Malware and Solana Wallet Drainer

Two separate fake Grand Theft Auto VI offers exposed visitors to distinct crypto theft mechanisms: a bogus Windows installer delivered a data-stealing malware loader, while a purported leaked-copy checkout prepared a transaction for nearly all the Solana (SOL) in a connected wallet. The findings do not link the two cases or their operators.

The malware campaign worked through a Google Colab notebook linked to a fake "Windows Software Hub" page. Its README told users to run the executable as administrator, bypass a Windows security warning and add an antivirus exclusion. The file wasn't a game installer. It was a loader for WARDEN Stealer, according to the technical analysis. In a test environment, the sample was detected and blocked before it could run.

What could the stealer actually do?

The sample's documented capabilities go well beyond grabbing a single password file. The malware could collect:

• saved passwords, browser cookies and browsing data
• browser-extension secrets
• Steam and Roblox credentials
• cryptocurrency wallet information

It could also inject code directly into browser processes, replace copied crypto addresses on the clipboard — a classic swap attack that redirects transfers to attacker-controlled wallets — and download additional malware payloads.

These are capabilities of the analyzed sample. The findings do not establish successful infections or actual user losses.

How did the Solana drainer work?

The second scheme ran through latestgta6.com, which advertised a purported leaked copy of the game for $50 or 1 Solana. Selecting the "1 SOL" option triggered a script that checked the connected wallet's balance and prepared a transaction leaving 0.005 SOL behind for fees while requesting the rest. For a wallet holding 25 SOL, the drainer would request 24.995 SOL.

The design still required a signature. A visitor had to approve and sign the transaction; simply opening the page didn't move funds. That friction is the last line of defense for wallet users, and it's the step drainer kits are engineered to defeat through misleading prompts.

The core script, a 2.4-megabyte file named lucifer.v8.js, also appeared on 12 other domains, eight of which were still serving it as of Friday, Nov. 13. The code could request transfers or token and NFT permissions across Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base and Fantom — meaning its reach extended far beyond Solana to the major EVM chains and the ERC-20 and ERC-721 token standards that run on them.

Are the two campaigns connected?

The installer and checkout use different mechanisms entirely. One seeks data from a computer. The other asks a wallet holder to sign a transaction. The shared script across 13 domains doesn't establish a single operator, and neither case has a confirmed victim count or a verified loss total.

For users, the operational lesson is straightforward: Rockstar Games lists Grand Theft Auto VI only for PlayStation 5 and Xbox Series X|S, with a release date of Nov. 19. Its listing does not include a PC version. Any site offering a PC install or a leaked copy is offering something that doesn't officially exist.

The technical findings add detail to earlier coverage of GTA VI offers seeking crypto payments and wallet access. With the Nov. 19 console launch approaching, expect fraudulent PC-version lures to intensify through the release window and the weeks after it.