That “Play Now” button for a GTA 6 demo may feel like a lucky find, but fake sites impersonating Rockstar Games are currently distributing a malicious executable disguised as a demo installer — and clicking it could cost far more than an afternoon. According to Malwarebytes security analysis, the payload belongs to the Vidar infostealer family. The goal isn’t to waste your time. It’s to drain your digital life. Rockstar has released no playable demo. Their official “Extended Look” page contains promotional videos and screenshots only — no game installer, no early access build. What’s circulating is a credential-harvesting campaign timed to exploit one of the most anticipated releases in years.
The scam mechanics are straightforward. Fake pages clone Rockstar’s branding, promotional style, and language — right down to “Play Now” calls to action — to serve a file called gta6_installer.exe. That file is 1.1 MB. A 1.1 MB “game demo” is like a sushi restaurant that only lists one menu item: something is catastrophically wrong. Real AAA builds run gigabytes. This one runs about the size of a PDF.
Here’s what that installer is actually after, per Malwarebytes:
- Browser-saved passwords
- Session cookies and authenticated logins
- Autofill data and browsing history
- Saved browser profiles
- FTP credentials
Session cookies are the most dangerous item on that list. Stolen cookies let attackers access your accounts without ever needing your password — and because they hijack an already-authenticated session, even two-factor authentication offers limited protection. Your login wall becomes largely irrelevant.
Already Ran the File? Do This Now
Acting fast after running the file can limit the damage — here’s the exact order of operations.
If the file has already executed on your machine, act immediately. Change every critical password from a separate clean device, then sign out of all active sessions across your accounts. Audit your account recovery settings and enable two-factor authentication everywhere it isn’t already active. Scan your device as part of that process. This guidance comes directly from Malwarebytes security reporting.
This is the Nigerian prince email for the Discord generation — same psychological exploit, sharper branding. The more anticipated the release, the more effective the trap. Real demos get announced on official channels. They don’t materialize on random domains with a 1.1 MB installer and a borrowed Rockstar logo. Trust the size. Trust the source. Trust nothing else.
