This week, a hacker group published gameplay clips of GTA VI, the game’s map, and at least one story cutscene online, claiming to protest Take-Two’s decision to skip a physical release. With the game launching on November 19 and more material threatened, fans are hunting down the footage across social media, forums, and file-sharing sites.

That scramble is a security risk in itself. NordVPN’s Threat Intelligence team recently uncovered a wave of malware and scam campaigns built specifically around GTA VI hype, and researchers warn that moments like this are when such campaigns do the most damage.

“Every time GTA VI makes headlines, leaked footage spreads through re-uploads, Discord links, and unofficial mirrors, which is exactly the environment where fake ‘leak’ downloads and credential-harvesting pages thrive,” says Marijus Briedis, CTO at NordVPN. “Fans looking for leaks or removed clips might land on unfamiliar sites, and in that moment they trust what they find. That’s the window attackers exploit.”

What the Research Found

The campaigns NordVPN identified earlier this year span several attack types:

• Fake Beta Keys and Subscription Traps: Scam sites promising exclusive beta access for PS5 and Xbox Series funnel users through fake verification steps into paid subscriptions and potentially unwanted applications.
• Trojanized Repacks for Windows: Attackers cloned well-known piracy and repack sites, including fake versions of FitGirl, DODI, and ElAmigos, to push malware disguised as game files. One analyzed sample hid a malicious file posing as an NVIDIA graphics driver component, capable of downloading additional malware and connecting to external servers. The domain had been registered just 23 days before the attack was detected.
• Android Adware Posing as a “GTA 6 Beta”: The fake app shows authentic-looking Rockstar branding, then silently serves full-screen ads and redirects users to pages pushing subscriptions or further malware. The trail leads to a domain with a documented history of distributing infostealers, banking trojans, and ransomware.
• Phishing Pages Targeting Rockstar Social Club Accounts: Hundreds of amateur pages using fake login forms, many hosted on trusted platforms like GitHub and Vercel. Compromised accounts can be resold on dark web marketplaces or used for in-game fraud.

How to Stay Safe

Marijus Briedis advises gamers and GTA VI fans to:

• Avoid third-party download sites for any game content. Legitimate game files are distributed exclusively through official storefronts like the PlayStation Store, Xbox Marketplace, or Rockstar’s own platform. Any unofficial site should be treated as a red flag.
• Treat beta key offers with skepticism. Legitimate betas for major titles are announced through official channels only. Any site asking you to verify your identity or subscribe to a service to claim access is a scam, regardless of how convincing it looks.
• Check URLs carefully before logging in. Official game platforms and storefronts will never ask you to sign in through a third-party site.

With the release of Grand Theft Auto VI only a few months away, it is important that everyone is careful. Also, if you come across some leaked material, do not share it. Show some respect for other gamers and don’t try to ruin the experience for others.

Have you come across any of this material? Tell us what you think on Bluesky and Twitter.