A 796 KB file cannot be a game that needs 212 GB of space
Grand Theft Auto VI launches on 19 November 2026 for PlayStation 5 and Xbox Series X|S only, and Rockstar has not announced a PC version, Help Net Security reported. Any site offering a PC installer is offering something other than the game. One such offer hides WARDEN Stealer, password-stealing malware that goes after saved logins, Steam credentials and crypto wallets, according to security firm Cynet.
The giveaway is the file size. The scam page advertises a 72 MB download. Inside the ZIP is a 796 KB executable and a 1 KB README. The real game needs up to 212 GB of storage space for its preload, as TechReview reported. That preload story is about the legitimate game and is not connected to this scam. Our calculation, using binary sizes: 212 GB of storage is about 3,000 times the advertised 72 MB, and about 279,000 times the 796 KB file that actually runs. The size gap is the first giveaway, not the proof. The proof is what Cynet found inside the file: a stealer, not a game.
| What you get | Size |
|---|---|
| Advertised download | 72 MB |
| File inside the ZIP | 796 KB executable + 1 KB README |
| Real GTA 6 preload | Up to 212 GB of storage space |
| Real game vs advertised download | About 3,000x larger |
| Real game vs actual file | About 279,000x larger |
How the scam reaches your PC
The lure starts in a Google Colab notebook promoting a “GTA 6 EXE FILE DOWNLOAD”, Cynet reported. The notebook links to a page called “Windows Software Hub” that shows a version number, a download count and “Virus Free”, “Secure” and “Verified” badges, plus a “0 threats detected” claim. None of those statements verify the file’s safety, and the download count was not independently verified, so it is no evidence of popularity or safety.
The page advertises a 72 MB download, but the ZIP file, named Gta_6_Exe_File_Download.zip, holds only a 796 KB executable and a 1 KB README, Help Net Security reported. The README does the persuading. It tells the user to run the executable as administrator, click past a security warning, and add an antivirus exclusion if the file is blocked. Each of those steps is a red flag on its own. Together they are the scam asking the victim to switch off the defences that would stop it.
The badges do the rest of the convincing. “Virus Free”, “Secure” and “Verified” sound like independent checks, but Cynet found they do not verify the file’s safety. They are the scammers’ own claims on a page they built themselves, and the “0 threats detected” claim works the same way.
The executable is not GTA 6. It is a heavily obfuscated WARDEN Stealer loader, Cynet found. The binary contains no game engine, no game assets and no Rockstar signatures. The people it targets are those searching for early access, a leaked build, or a free GTA 6 download for PC, Help Net Security reported. With launch four days away and no PC version in sight, that search is exactly where the scam waits.
What WARDEN Stealer takes once it runs
WARDEN Stealer goes after saved passwords, cookies, browsing data and browser-extension secrets, Cynet reported. It also steals Steam and Roblox credentials and cryptocurrency-wallet information. It evades virtual machines and sandboxes, injects code into browser processes, and replaces cryptocurrency addresses copied to the clipboard, so a payment meant for one wallet goes to the attacker’s instead. It can also download additional malware, which means the first infection may not be the last thing that lands on the machine.
In Cynet’s test, the file triggered a High-severity malicious-binary “Attempt to Run” alert and a Critical “Unauthorized Memory Access Attempt” alert, and Cynet detected and blocked it. A connection attempt to wooocommerce[.]shopping was identified as a known malware-serving domain and blocked.
Cynet named uroker[.]casa as the probable command-and-control server, with high confidence, and published SHA-256 hashes for the executable and the README so defenders can check for them. Cynet also listed 104.21.75[.]176 but warned against blocking it because it is a shared Cloudflare IP.
Executable SHA-256: 6444a4e18c9ca99b5516e5365baac88bf4d62182e3630451b202c9bfb4ccbc0b
README SHA-256: d56abdfd6b0f00059bace02d168ed9d053621aa809325f112069d23f192f8b35
A second scam is draining wallets instead
A separate scam variant does not bother with a download at all. A fake sales page at latestgta6.com advertised a leaked copy for $50 or 1 SOL, Coin Edition reported. Malwarebytes first flagged the site on 1 September 2026. A fake 1 SOL offer on the page was coded to request nearly all of a connected wallet’s balance, but the transfer still needs the victim to approve it in the wallet. Visiting the page alone does not move funds. SafeBrowz found the same lucifer.v8.js file on 12 other domains, and eight were still serving it on 13 November 2026.
ESET rounded up the GTA 6 scams it and others had tracked on 13 November 2026, The Leonida reported. The pattern is the same across them: the launch is days away, the game is not on PC, and anyone promising an early or free PC copy is selling something else.
How do I spot a fake GTA 6 download?
GTA 6 launches 19 November for PlayStation 5 and Xbox Series X|S only, with no PC version announced. Any PC installer is fake, whatever its size. Download only from Rockstar, PlayStation or Xbox, and treat a page asking you to disable antivirus as a serious red flag.
- Download GTA 6 only from Rockstar, PlayStation or Xbox, never from a download site or shared link.
- Check the platform first: if a page offers a PC version, close it, because none exists.
- Check the size: a 796 KB executable cannot be a full game needing 212 GB of storage.
- Never run a downloaded game file as administrator or add an antivirus exclusion for it.
- Never click past a security warning to install a game downloaded from an unknown source.
- Check your Steam, email and crypto wallet accounts for logins or transfers you did not make.
What is confirmed, and what is not
Confirmed: Grand Theft Auto VI launches 19 November 2026 for PlayStation 5 and Xbox Series X|S only, with no PC version announced. The scam page advertises a 72 MB download, while the ZIP holds a 796 KB executable and a 1 KB README. The README tells users to run the file as administrator and add an antivirus exclusion. WARDEN Stealer steals saved passwords, cookies, browser-extension secrets, Steam and Roblox credentials and crypto-wallet information. Cynet named uroker[.]casa as the probable command-and-control server. A second scam at latestgta6.com advertised a leaked copy for $50 or 1 SOL; Malwarebytes first flagged the site on 1 September 2026. Netcraft’s 3 November study identified 121 newly registered domains carrying the “Cyberleek” name, 100 of them in August, and checked what the pages showed: one offered a GTAVI.exe file flagged as a trojan by 34 of 68 VirusTotal engines, while another asked visitors for $100 in crypto to unlock the game.
Not confirmed: no confirmed victim count exists. The download count on the lure page is the page’s own claim, not a victim count, and no source gives a number of downloads or infections. Whether stolen data has been sold or used is not established. The command-and-control domain is Cynet’s assessment, described as probable with high confidence, not independently confirmed.
What to watch next
First, whether Rockstar or a security firm reports infections or takedowns before launch day. Second, whether the lure moves from Google Colab to other platforms as notebooks get removed. Third, whether the wallet-drainer domains are taken down, since eight were still serving the file on 13 November. And fourth, any new variant that appears in the final days before 19 November, as ESET expects the lures to shift around launch.
