Fake GTA 6 Leak Site Targets Crypto Wallets With Malicious Drainer

Yet another scam built around Grand Theft Auto VI, one of the most anticipated computer games in years, is taking aim at crypto users. 

Cybersecurity firm Malwarebytes has uncovered a fake GTA 6 website that presents itself as a fan countdown and invites visitors to download an alleged leaked copy of Rockstar Games’ much-talked-about title. 

To absolutely no one’s surprise, the convincing-looking page contains a cryptocurrency wallet drainer that can simultaneously target multiple blockchain networks.

The site combines genuine-looking GTA 6 information with a malicious payment scheme that is designed to connect a crypto wallet. 

Users who approve the wrong transaction could potentially lose much more than the advertised purchase price.

Malwarebytes previously identified websites offering supposed “early access” for cryptocurrency and later found fake GTA 6 demo and “Extended Look” pages.

To gain some legitimacy, the website features some legitimate promotional material while correctly stating that the game is coming to PlayStation 5 and Xbox Series X|S. Rockstar has not announced a PC version.

They are two offers of a supposedly leaked copy that have been mixed in with  legitimate-looking material. One asks for $50 while another requests 1 SOL. worth roughly $102 at the time Malwarebytes analyzed the site.

Moreover, the operators also attempt to establish trust by warning visitors that other websites claiming to offer GTA 6 leaks are scams. 

There are, however, several obvious inconsistencies once the page is examined more closely. Its footer says the website does not offer purchases. Elsewhere, the site says GTA 6 is console-only while its FAQ promises a PC download after payment. 

Malwarebytes also found errors in the sales copy, including a misspelled reference to downloading and a reference to GTA IV instead of GTA VI.  

Malwarebytes found two separate pieces of malicious code in the payment option section. One targets Solana wallets and calculates a transfer designed to leave only enough funds behind to cover transaction fees. The second component is a much larger script that is capable of targeting wallets across Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base and Fantom. It poses as a legitimate wallet-connection tool, but Malwarebytes has found malicious code added on top of it.  

Just days ago, as reported by U.Today, the mysterious figure linked to a separate wave of GTA VI leaks was reported to have moved roughly $350,000 out of the CYBERLEEK crypto operation, according to blockchain analysis. The individual behind the leaks has not been publicly identified.