Huntress Warns Fake GTA 6 Downloads Are Spreading Malware Ahead of November Release

Huntress said it recently saw one variant deploying a range of threats, from RATs to infostealers and full ransomware encryptors. The fake downloads have been promoted through SEO poisoning, with websites ranking relatively high in search results and offering an ISO of the game. Similar ISO files are circulating on gaming forums, torrenting sites, and social media channels, according to the researchers.

An ISO file is a digital copy of an entire disc, such as a CD, DVD, or Blu-ray, stored as a single file. Users can download an ISO, mount it into a virtual drive, and have the computer treat it like a physical disc. Huntress found some ISOs weighing more than 100GB, a size that appears intended to make the download seem authentic. The actual malware was described as a factor smaller.

The ISOs analyzed contained multiple malicious variants, including NJRAT and CDRAT, two remote access trojans, and Mercurial Grabber, an infostealer that collects Roblox Studio cookies, Minecraft session data, Discord tokens, Chrome passwords and cookies, system information, IP addresses, geolocation, Windows product keys, and screenshots. The package also contained Chaos Ransomware and a legitimate, regular browser, which Huntress said appeared to be included “just for kicks.”

During the supposed game installation, the installer displays a message in Russian saying the product is unlicensed and that there is a good chance it will not run. If that happens, the user is told to contact a specific Gmail address to receive an “updated crack.” After installation completes, the victim receives a popup saying “License not found.” Huntress said all of this is a smoke screen intended to keep the victim from becoming suspicious about why the game will not run.

There is no way to tell how many people have fallen for the ruse and installed malware on their devices. Huntress said that downloading cracked and pirated software is generally a bad idea, and that the risk is worse when the game in question has not yet been released. “This is fertile ground for scams and threat actors attempting to take advantage of the impatient and overeager,” the researchers said.

GTA 6 is a third-person action-adventure and open-world game developed by Rockstar Games. It is a sequel to GTA 5, which sold more than 230 million copies worldwide. Rockstar began preliminary work on GTA 6 more than a decade ago, and the game is alleged to have cost more than a billion dollars, which would make it by far the most expensive game ever developed. In late August 2026, someone using the alias LEEK claimed to have obtained a working, playable build of the game roughly six months before release, posting screenshots and videos, including one in which they wrote their nickname on a wall using a rifle to prove authenticity. Huntress noted that even without that claim, people would probably have searched for and downloaded fake installers.

The good news, according to Huntress, is that none of the malware being distributed is new. Some variants contained in the ISOs are several years old, meaning most antivirus programs, such as Windows Defender, can easily detect and stop them from compromising a system. Huntress advised anyone who does end up infected to disconnect the machine from the internet, reset all passwords, enable two-factor authentication wherever possible, and completely reimage the compromised system.

Editor's Summary

Fake GTA 6 ISO files are circulating online ahead of the game’s November 19, 2026 release, and Huntress says they deliver remote access trojans, infostealers, and Chaos ransomware. The malware is not new and can often be detected by antivirus software, but infected users are advised to disconnect, reset credentials, enable 2FA, and reimage affected systems.