Grand Theft Data: Threat Actors Weaponizing GTA 6 Hype, NordVPN Warns

In brief

• Threat actors are aggressively exploiting pre-order anticipation for GTA 6 by targeting PC and mobile users with fake applications.
• Attackers, according to NordVPN, are cloning well-known piracy websites to distribute fake game packages with hidden malware.
• GTA 6 has been rumored to use crypto, but those whispers have gone unsubstantiated as the game nears its November release.

Cybercriminals are weaponizing widespread excitement surrounding Grand Theft Auto 6, flooding the internet with phishing traps and malware repacks ahead of the game’s highly anticipated November release.

According to research from NordVPN’s Threat Intelligence team, bad actors quickly moved to capitalize on recent rumors that pre-orders for the game could be open soon, welcoming the hype as an opportunity to harvest data from unwitting victims—or worse.

The pitfalls range from amateur phishing sites to sophisticated, multi-platform malware campaigns targeting platforms that the game won't even initially support, NordVPN said. Still, the threats are appearing in all shapes and sizes for gamers, the firm added.

Although the VPN provider’s researchers identified campaigns targeting PC and mobile users—platforms on which GTA 6 is not confirmed to release—several websites are promising “exclusive beta keys” for owners of PS5 and Xbox Series consoles. In one case, users seeking access are prompted to pay for subscriptions or download software.

The company’s work exposes how cybercriminals will often prey on FOMO, or the fear of missing out, NordVPN CTO Marijus Briedis said in a statement.

“When people are desperate to get early access to something, their guard comes down,” he noted. “That’s the window attackers exploit.”

Other cybercriminals are targeting gamers who want to get their hands on Rockstar Games’ next title for free: NordVPN identified several clones of well-known piracy websites that were designed to distribute malware disguised as game files for Windows machines.

In one instance, running a fake package activated a malicious file disguised as an Nvidia graphics driver, which quietly allowed cybercriminals to alter a device’s memory, download additional malware, and receive external instructions, according to NordVPN.

What’s more, a fake Android app—which contains no actual game—takes advantage of the game’s branding to silently serve full-screen ads. The app’s users are also directed to websites that coax them into subscriptions or downloading further malware, NordVPN said.

Finally, NordVPN said it has tracked “hundreds of amateur phishing pages” that target Rockstar Social Club credentials via fake login forms. NordVPN noted that these accounts can be resold on the dark web or used to commit in-game fraud.