Fake GTA 6 'Extended Look' and Demo Sites Deliver Vidar Infostealer

Key facts for Vidar GTA 6 fake installer

Detection coverage for Vidar GTA 6 fake installer

As of 2026-08-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2132 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Vidar Headless Browser Credential Harvesting and Anti-Analysis Behavior (Splunk)

Detects Vidar's post-exploitation behavior: driving installed Chrome/Edge/Firefox/Brave/Opera/Vivaldi/Thunderbird binaries in headless/automation mode from a non-browser parent to pull saved passwords, session cookies, autofill data and browsing history (T1555.003/T1539/T1552.001/T1005), plus the sandbox/VM discovery checks (T1082/T1497.001) and installer self-deletion (T1070.004) Vidar performs around the theft.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1555.003, T1539, T1552.001, T1005, T1082, T1497.001, T1070.004
• Data sources: sysmon, windows_security, edr_telemetry
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\chrome.exe" OR Image="*\\msedge.exe" OR Image="*\\firefox.exe" OR Image="*\\brave.exe" OR Image="*\\opera.exe" OR Image="*\\vivaldi.exe" OR Image="*\\thunderbird.exe")
(CommandLine="*--headless*" OR CommandLine="*--remote-debugging-port*" OR CommandLine="*--disable-gpu*" OR CommandLine="*--user-data-dir=*" OR CommandLine="*--no-sandbox*")
ParentImage!="*\\explorer.exe"
| eval stage="headless_browser_credential_harvesting"
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      (Image="*\\systeminfo.exe" OR (Image="*\\wmic.exe" AND (CommandLine="*computersystem*" OR CommandLine="*bios*" OR CommandLine="*diskdrive*")) OR (Image="*\\cmd.exe" AND CommandLine="*tasklist*"))
      (ParentImage="*\\gta6_installer.exe" OR ParentImage="*\\AppData\\Local\\Temp\\*")
      | eval stage="sandbox_vm_discovery_evasion" ]
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      Image="*\\cmd.exe" (CommandLine="*del /f /q*" OR CommandLine="*/c del*" OR CommandLine="*timeout*&&*del*")
      (ParentImage="*\\gta6_installer.exe" OR ParentImage="*\\AppData\\Local\\Temp\\*")
      | eval stage="self_deletion_indicator_removal" ]
| table _time, ComputerName, User, ParentImage, Image, CommandLine, stage
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe","vivaldi.exe","thunderbird.exe")
| where ProcessCommandLine has_any ("--headless","--remote-debugging-port","--disable-gpu","--user-data-dir","--no-sandbox")
| where InitiatingProcessFileName !in~ ("explorer.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, Stage = "headless_browser_credential_harvesting"

Sigma

title: Vidar Headless Browser Credential Harvesting
id: 8b1c3d5e-2f4a-4c6b-8d9e-3a4b5c6d7e8f
status: experimental
description: Detects an installed browser launched with headless/automation flags by a non-browser parent process, consistent with Vidar driving legitimately-installed browsers to harvest saved passwords, session cookies, autofill data, and history without breaking OS credential encryption.
references:
    - https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-gta-6-extended-look-and-demo-sites-deliver-an-infostealer
    - https://www.picussecurity.com/resource/blog/vidar-malware-how-the-multithreaded-windows-stealer-works
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-24
tags:
    - attack.credential-access
    - attack.t1555.003
    - attack.t1539
    - attack.t1552.001
    - attack.collection
    - attack.t1005
    - attack.tool.vidar
logsource:
    category: process_creation
    product: windows
detection:
    selection_browser:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
            - '\vivaldi.exe'
            - '\thunderbird.exe'
    selection_flags:
        CommandLine|contains:
            - '--headless'
            - '--remote-debugging-port'
            - '--disable-gpu'
            - '--user-data-dir='
            - '--no-sandbox'
    filter_legit_parent:
        ParentImage|endswith:
            - '\explorer.exe'
    condition: selection_browser and selection_flags and not filter_legit_parent
falsepositives:
    - Legitimate browser automation/testing frameworks (Selenium, Puppeteer, Playwright) launched by CI/CD or QA tooling
    - IT-managed browser update or profile-migration scripts using automation flags
level: high

Known false positives:

• Legitimate browser automation/testing frameworks (Selenium, Puppeteer, Playwright) launched by CI/CD, QA, or RPA tooling with headless flags
• IT-managed profile migration or browser-update scripts using automation command-line switches

Tuning notes: Baseline legitimate headless-browser usage in your environment (CI/CD runners, RPA bots) and exclude their known service accounts/hosts; tighten by requiring the non-browser parent process to also be unsigned or recently dropped to disk.

• 🔒 Trojanized GTA 6 Installer Download and Execution (Microsoft Sentinel/Defender) · unlock with TL Creds
• 🔒 Vidar Headless Browser Credential Harvesting and Anti-Analysis Behavior (Microsoft Sentinel/Defender) · unlock with TL Creds
• 🔒 Vidar Dead-Drop Resolver Lookup and Round-Robin C2 Exfiltration (Microsoft Sentinel/Defender) · unlock with TL Creds
• 🔒 Trojanized GTA 6 Installer Execution (Sigma) · unlock with TL Creds
• 🔒 Vidar Sandbox/VM Discovery and Installer Self-Deletion (Sigma) · unlock with TL Creds
• 🔒 Vidar Multipart HTTP POST Exfiltration to Round-Robin C2 (Sigma) · unlock with TL Creds
• 🔒 Trojanized GTA 6 Installer Download and Execution (Splunk) · unlock with TL Creds
• 🔒 Vidar Dead-Drop Resolver Lookup and Round-Robin C2 Exfiltration (Splunk) · unlock with TL Creds

Indicators of compromise for Vidar GTA 6 fake installer

As of 2026-08-24, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-2132.

Sample indicators (3 of 29)

• Domain: gta6demo[.]asia
• URL: hxxps://telegram[.]me/m1duus
• File hash: a8f19d598e6a49d8510d73d41fc445246755ed321c2f76985a463a9fef537eb0

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

How Vidar GTA 6 fake installer works

On or around August 19, 2026 — one day after gameplay footage attributed to a leak-branding group calling itself 'Cyberleek' began circulating online — threat actors stood up a small cluster of typosquat/lookalike domains (gta6demo[.]asia, gta6demo[.]eu, gta6demo[.]us, and rockstar-gta-6[.]com) that impersonate official Rockstar Games GTA 6 promotional pages and offer a fake playable 'demo' download. The lure is timed deliberately: it front-runs Rockstar's confirmed real 'Extended Look' trailer premiere on Netflix on August 27, 2026, so search interest and social sharing around the genuine event drive traffic to the fake sites.

Visitors who click the site's 'Play Now' button are served gta6_installer.exe, a 1.1MB Windows PE (SHA-256 a8f19d598e6a49d8510d73d41fc445246755ed321c2f76985a463a9fef537eb0), first observed by Malwarebytes ThreatLabs on August 19, 2026. Running the installer deploys Vidar, a long-running (active since 2018) commodity infostealer sold as malware-as-a-service to a broad affiliate base, which explains why this campaign carries none of the hallmarks of a single named APT and is instead opportunistic, hype-driven crimeware.

Rather than attacking browser encryption directly, the sample launches the legitimately-installed Chrome, Edge, and Firefox executables already present on the victim host in headless/automation mode, using the browsers' own access to their protected-storage APIs to pull saved passwords, session cookies, autofill entries, browsing/download history, and stored logins without needing to defeat OS-level credential encryption itself. Malwarebytes documented targeting across 19 browser targets in total, including Chrome, Edge, Firefox, Brave, Opera, Vivaldi, Perplexity Comet, the Roblox Studio WebView2 runtime, and Thunderbird mail-client profiles, plus separate harvesting of locally stored FTP client credentials.

For command-and-control, the sample follows Vidar's well-documented dead-drop-resolver pattern (MITRE ATT&CK T1102.001): rather than hardcoding a C2 address, it queries attacker-controlled profile pages on legitimate platforms — telegram[.]me/m1duus, t[.]me/m1duus, pinterest[.]com/m1duus, and steamcommunity[.]com/profiles/76561198657426610 — whose page content resolves to the live second-stage C2 endpoint (observed as ses.1001gacor[.]org and ket.sm188daftar[.]mom, backed by a wider round-robin pool of over a dozen additional *.1001gacor[.]org, *.11gokil[.]org, and *.sm188dnsx[.]top subdomains). This lets the operators rotate backend C2 servers freely while the resolver front-ends stay stable and blend into normal social-platform traffic, and stolen data is transmitted out via HTTP multipart POST to whichever C2 endpoint the resolver currently points at.

This is not the first GTA 6 leak-hype scam of 2026: an earlier campaign charged victims directly for bogus 'early access' to the game. The pattern is consistent — threat actors treat every high-visibility GTA 6 media beat (leaks, trailers, premieres) as a fresh social-engineering hook for credential-stealing malware distribution, and can be expected to repeat this playbook around the actual August 27 Netflix premiere and any subsequent official Rockstar marketing beats.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 Indicator Removal: File Deletion; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1622 Debugger Evasion

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver

Discovery

T1082 System Information Discovery

Execution

T1204.001 Malicious Link

Credential Access

T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1608.001 Stage Capabilities: Upload Malware

Remediation for Vidar GTA 6 fake installer

Immediate actions

• Block the distribution domains gta6demo[.]asia, gta6demo[.]eu, gta6demo[.]us, and rockstar-gta-6[.]com at DNS/web proxy
• Block the C2 and dead-drop infrastructure (ses.1001gacor[.]org, ket.sm188daftar[.]mom, all *.1001gacor[.]org, *.11gokil[.]org, and *.sm188dnsx[.]top subdomains) at network egress
• Alert on and quarantine files matching SHA-256 a8f19d598e6a49d8510d73d41fc445246755ed321c2f76985a463a9fef537eb0 (gta6_installer.exe)
• Force password resets and full session/cookie invalidation for any host confirmed to have executed gta6_installer.exe

Workarounds

• Only download GTA 6 content from Rockstar Games' official site/launcher or the official Netflix premiere channel; treat every unofficial 'Play Now'/'demo' download as hostile

Longer-term hardening

• Deploy EDR behavioral detection for unattended/automation-flagged launches of installed browser binaries (headless Chrome/Edge/Firefox spawned by a non-browser parent process)
• Run user-awareness messaging ahead of high-hype game/media releases warning against third-party 'demo' or 'early access' downloads
• Prefer dedicated OS-independent password managers over browser-native credential storage to reduce single-artifact credential exposure

Affected and fixed versions

• Multiple — Web browsers and mail clients targeted for credential/session harvesting: Chrome, Microsoft Edge, Firefox, Brave, Opera, Vivaldi, Perplexity Comet, Roblox Studio WebView2, Thunderbird
  Vulnerable versions: any version storing credentials/sessions via the browser's native protected-storage mechanism

Timeline of Vidar GTA 6 fake installer

• 2022-09-18 Rockstar Games suffers the original GTA 6 data breach: a Lapsus$-affiliated hacker ('teapotuberhacker') posts over 90 leaked alpha-footage videos and source-code files to GTAForums.com, establishing GTA 6 leak content as a recurring social-engineering hook that scammers have exploited ever since.
• 2026-06-25 An earlier, distinct fake-GTA-6-installer infostealer incident (GTA6_Setup_Crack_2026.exe, detected and contained by EDR within 3 minutes 44 seconds of execution) is documented independently by researcher Manubhav Sharma, establishing precedent for the fake-installer-as-infostealer-lure pattern this campaign repeats.
• 2026-08-18 GTA 6 gameplay footage begins circulating online; a group branding itself 'Cyberleek' is credited with the leak, creating the hype the campaign later exploits.
• 2026-08-19 Malwarebytes ThreatLabs first observes the trojanized locked-ioc-8 (SHA-256 locked-ioc-1) being served from the fake GTA 6 demo/typosquat domains — one day after the leak footage appeared.
• 2026-08-22 FinalBoss.io publishes a consumer warning about fake 'Cyberleek build' downloads and GTA 6 leak-themed scams distributing malware.
• 2026-08-24 Malwarebytes publishes technical threat-intel analysis identifying the campaign's Vidar payload, dead-drop-resolver C2 infrastructure, and 19-browser credential-theft scope; Malwarebytes confirms detection and blocking of the sites and infrastructure.
• 2026-08-27 Rockstar Games' genuine GTA 6 'Extended Look' premieres on Netflix — the real-world event the fake demo sites are timed to ride ahead of and free-ride the search/social traffic from.
• 2026-11-19 GTA 6's official scheduled retail release date for PlayStation 5 and Xbox Series X|S — the terminal hype milestone this and prior GTA 6-themed malware campaigns are expected to continue exploiting through.

Sources cited for Vidar GTA 6 fake installer

• Reversing a GTA VI 'leak site' infostealer - Vidar behind a custom obfuscator [IN DEPTH ANALYSIS] medium.com · Research
• Fast, Broad, and Elusive: How Vidar Stealer 2.0 Upgrades Infostealer Capabilities Trend Micro · Research
• Vidar Stealer: Malware Evolution & Acronis Defenses acronis.com · Vendor report
• Vidar Malware: How the Multithreaded Windows Stealer Works picussecurity.com · Research
• Web Service: Dead Drop Resolver, Sub-technique T1102.001 - Enterprise MITRE · Research
• The other GTA VI lure - a ClickFix loader that leaked its own C2 medium.com · Research
• Fake GTA 6 'Extended Look' and demo sites deliver an infostealer malwarebytes.com · Blog · 2026-08-24
• GTA 6 Leak Scams: Avoid Fake Cyberleek Builds and Malware Downloads finalboss.io · Blog · 2026-08-22
• How I Caught an Infostealer in 4 Minutes: A Fake GTA 6 Installer Investigation systemweakness.com · Blog
• C2 powered by Steam intelinsights.substack.com · Blog
• Fake copies of GTA 6 which are actually malware circulating on piracy sites branded as Cyberleek resetera.com · News
• Rockstar Games Confirms GTA 6 Leak; Hacker Identified As Lapsus$ Member lowyat.net · News · 2022-09-18

More in malware

• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)
• Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)

Previous and next in malware

• SynkLoader: Modular Multi-Language Loader Deployed via Microsoft Teams Phishing, Likely Ransomware Precursor Previous report
• TrickBot injectDLL Module: Man-in-the-Browser Web Injection Against Certificate Transparency Next report