# Fake GTA 6 'Extended Look' and Demo Sites Deliver Vidar Infostealer

> Threat actors registered typosquat GTA 6 domains offering a bogus playable demo timed to Rockstar Games' real August 27, 2026 'Extended Look' Netflix premiere. A 'Play Now' button serves a 1.1MB trojanized installer (gta6_installer.exe) that deploys the Vidar infostealer, which drives the victim's own installed Chrome, Edge, and Firefox binaries headlessly to harvest passwords, session cookies, autofill data, browsing history, and FTP credentials across 19 browsers, then exfiltrates the loot to Vidar C2 infrastructure reached via Telegram/Steam/Pinterest dead-drop resolver profiles.

- **Published:** 2026-08-24T00:00:00Z
- **Last reviewed:** 2026-08-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2132
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-vidar-gta-6-fake-installer-tl-2026-2132.webp?v=b0afbd63 (Threadlinqs threat intel: Vidar Infostealer via Fake GTA 6 Demo: Detection & IOCs (TL-2026-2132) — High severity, 29 IOCs, 9 detection rules.)
- **ID:** TL-2026-2132
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

On or around August 19, 2026 — one day after gameplay footage attributed to a leak-branding group calling itself 'Cyberleek' began circulating online — threat actors stood up a small cluster of typosquat/lookalike domains (gta6demo[.]asia, gta6demo[.]eu, gta6demo[.]us, and rockstar-gta-6[.]com) that impersonate official Rockstar Games GTA 6 promotional pages and offer a fake playable 'demo' download. The lure is timed deliberately: it front-runs Rockstar's confirmed real 'Extended Look' trailer premiere on Netflix on August 27, 2026, so search interest and social sharing around the genuine event drive traffic to the fake sites.

Visitors who click the site's 'Play Now' button are served gta6_installer.exe, a 1.1MB Windows PE (SHA-256 a8f19d598e6a49d8510d73d41fc445246755ed321c2f76985a463a9fef537eb0), first observed by Malwarebytes ThreatLabs on August 19, 2026. Running the installer deploys Vidar, a long-running (active since 2018) commodity infostealer sold as malware-as-a-service to a broad affiliate base, which explains why this campaign carries none of the hallmarks of a single named APT and is instead opportunistic, hype-driven crimeware.

Rather than attacking browser encryption directly, the sample launches the legitimately-installed Chrome, Edge, and Firefox executables already present on the victim host in headless/automation mode, using the browsers' own access to their protected-storage APIs to pull saved passwords, session cookies, autofill entries, browsing/download history, and stored logins without needing to defeat OS-level credential encryption itself. Malwarebytes documented targeting across 19 browser targets in total, including Chrome, Edge, Firefox, Brave, Opera, Vivaldi, Perplexity Comet, the Roblox Studio WebView2 runtime, and Thunderbird mail-client profiles, plus separate harvesting of locally stored FTP client credentials.

For command-and-control, the sample follows Vidar's well-documented dead-drop-resolver pattern (MITRE ATT&CK T1102.001): rather than hardcoding a C2 address, it queries attacker-controlled profile pages on legitimate platforms — telegram[.]me/m1duus, t[.]me/m1duus, pinterest[.]com/m1duus, and steamcommunity[.]com/profiles/76561198657426610 — whose page content resolves to the live second-stage C2 endpoint (observed as ses.1001gacor[.]org and ket.sm188daftar[.]mom, backed by a wider round-robin pool of over a dozen additional *.1001gacor[.]org, *.11gokil[.]org, and *.sm188dnsx[.]top subdomains). This lets the operators rotate backend C2 servers freely while the resolver front-ends stay stable and blend into normal social-platform traffic, and stolen data is transmitted out via HTTP multipart POST to whichever C2 endpoint the resolver currently points at.

This is not the first GTA 6 leak-hype scam of 2026: an earlier campaign charged victims directly for bogus 'early access' to the game. The pattern is consistent — threat actors treat every high-visibility GTA 6 media beat (leaks, trailers, premieres) as a fresh social-engineering hook for credential-stealing malware distribution, and can be expected to repeat this playbook around the actual August 27 Netflix premiere and any subsequent official Rockstar marketing beats.

## MITRE ATT&CK

- T1583.001 Acquire Infrastructure: Domains
- T1608.001 Stage Capabilities: Upload Malware
- T1204.001 Malicious Link
- T1027 Obfuscated Files or Information
- T1622 Debugger Evasion
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1070.004 Indicator Removal: File Deletion
- T1082 System Information Discovery
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Unsecured Credentials: Credentials In Files
- T1005 Data from Local System
- T1102.001 Web Service: Dead Drop Resolver
- T1071.001 Application Layer Protocol: Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Vidar Headless Browser Credential Harvesting and Anti-Analysis Behavior (Splunk)** (`TL-2026-2132-SPL-002`)

Detects Vidar's post-exploitation behavior: driving installed Chrome/Edge/Firefox/Brave/Opera/Vivaldi/Thunderbird binaries in headless/automation mode from a non-browser parent to pull saved passwords, session cookies, autofill data and browsing history (T1555.003/T1539/T1552.001/T1005), plus the sandbox/VM discovery checks (T1082/T1497.001) and installer self-deletion (T1070.004) Vidar performs around the theft.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1555.003, T1539, T1552.001, T1005, T1082, T1497.001, T1070.004
- **Data sources:** sysmon, windows_security, edr_telemetry
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\chrome.exe" OR Image="*\\msedge.exe" OR Image="*\\firefox.exe" OR Image="*\\brave.exe" OR Image="*\\opera.exe" OR Image="*\\vivaldi.exe" OR Image="*\\thunderbird.exe")
(CommandLine="*--headless*" OR CommandLine="*--remote-debugging-port*" OR CommandLine="*--disable-gpu*" OR CommandLine="*--user-data-dir=*" OR CommandLine="*--no-sandbox*")
ParentImage!="*\\explorer.exe"
| eval stage="headless_browser_credential_harvesting"
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      (Image="*\\systeminfo.exe" OR (Image="*\\wmic.exe" AND (CommandLine="*computersystem*" OR CommandLine="*bios*" OR CommandLine="*diskdrive*")) OR (Image="*\\cmd.exe" AND CommandLine="*tasklist*"))
      (ParentImage="*\\gta6_installer.exe" OR ParentImage="*\\AppData\\Local\\Temp\\*")
      | eval stage="sandbox_vm_discovery_evasion" ]
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      Image="*\\cmd.exe" (CommandLine="*del /f /q*" OR CommandLine="*/c del*" OR CommandLine="*timeout*&&*del*")
      (ParentImage="*\\gta6_installer.exe" OR ParentImage="*\\AppData\\Local\\Temp\\*")
      | eval stage="self_deletion_indicator_removal" ]
| table _time, ComputerName, User, ParentImage, Image, CommandLine, stage
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe","vivaldi.exe","thunderbird.exe")
| where ProcessCommandLine has_any ("--headless","--remote-debugging-port","--disable-gpu","--user-data-dir","--no-sandbox")
| where InitiatingProcessFileName !in~ ("explorer.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, Stage = "headless_browser_credential_harvesting"
```

### Sigma

```yaml
title: Vidar Headless Browser Credential Harvesting
id: 8b1c3d5e-2f4a-4c6b-8d9e-3a4b5c6d7e8f
status: experimental
description: Detects an installed browser launched with headless/automation flags by a non-browser parent process, consistent with Vidar driving legitimately-installed browsers to harvest saved passwords, session cookies, autofill data, and history without breaking OS credential encryption.
references:
    - https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-gta-6-extended-look-and-demo-sites-deliver-an-infostealer
    - https://www.picussecurity.com/resource/blog/vidar-malware-how-the-multithreaded-windows-stealer-works
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-24
tags:
    - attack.credential-access
    - attack.t1555.003
    - attack.t1539
    - attack.t1552.001
    - attack.collection
    - attack.t1005
    - attack.tool.vidar
logsource:
    category: process_creation
    product: windows
detection:
    selection_browser:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
            - '\vivaldi.exe'
            - '\thunderbird.exe'
    selection_flags:
        CommandLine|contains:
            - '--headless'
            - '--remote-debugging-port'
            - '--disable-gpu'
            - '--user-data-dir='
            - '--no-sandbox'
    filter_legit_parent:
        ParentImage|endswith:
            - '\explorer.exe'
    condition: selection_browser and selection_flags and not filter_legit_parent
falsepositives:
    - Legitimate browser automation/testing frameworks (Selenium, Puppeteer, Playwright) launched by CI/CD or QA tooling
    - IT-managed browser update or profile-migration scripts using automation flags
level: high
```

**Known false positives:**

- Legitimate browser automation/testing frameworks (Selenium, Puppeteer, Playwright) launched by CI/CD, QA, or RPA tooling with headless flags
- IT-managed profile migration or browser-update scripts using automation command-line switches

**Tuning notes:** Baseline legitimate headless-browser usage in your environment (CI/CD runners, RPA bots) and exclude their known service accounts/hosts; tighten by requiring the non-browser parent process to also be unsigned or recently dropped to disk.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Trojanized GTA 6 Installer Download and Execution (Microsoft Sentinel/Defender) (locked: unlock with TL Creds)
- Vidar Headless Browser Credential Harvesting and Anti-Analysis Behavior (Microsoft Sentinel/Defender) (locked: unlock with TL Creds)
- Vidar Dead-Drop Resolver Lookup and Round-Robin C2 Exfiltration (Microsoft Sentinel/Defender) (locked: unlock with TL Creds)
- Trojanized GTA 6 Installer Execution (Sigma) (locked: unlock with TL Creds)
- Vidar Sandbox/VM Discovery and Installer Self-Deletion (Sigma) (locked: unlock with TL Creds)
- Vidar Multipart HTTP POST Exfiltration to Round-Robin C2 (Sigma) (locked: unlock with TL Creds)
- Trojanized GTA 6 Installer Download and Execution (Splunk) (locked: unlock with TL Creds)
- Vidar Dead-Drop Resolver Lookup and Round-Robin C2 Exfiltration (Splunk) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- Domain: `gta6demo[.]asia`
- URL: `hxxps://telegram[.]me/m1duus`
- File hash: `a8f19d598e6a49d8510d73d41fc445246755ed321c2f76985a463a9fef537eb0`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Fake GTA 6 'Extended Look' and demo sites deliver an infostealer](https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-gta-6-extended-look-and-demo-sites-deliver-an-infostealer)
- [GTA 6 Leak Scams: Avoid Fake Cyberleek Builds and Malware Downloads](https://finalboss.io/gta-6-leak-scams-avoid-fake-cyberleek-builds-and-malware-downloads)
- [Reversing a GTA VI 'leak site' infostealer - Vidar behind a custom obfuscator IN DEPTH ANALYSIS](https://medium.com/@devmihaylov/reversing-a-gta-vi-leak-site-infostealer-vidar-behind-a-custom-obfuscator-in-depth-analysis-114fb89269fc)
- [How I Caught an Infostealer in 4 Minutes: A Fake GTA 6 Installer Investigation](https://systemweakness.com/how-i-caught-an-infostealer-in-4-minutes-a-fake-gta-6-installer-investigation-technical-blog-cff1aee7c6f6)
- [Fake copies of GTA 6 which are actually malware circulating on piracy sites branded as Cyberleek](https://www.resetera.com/threads/fake-copies-of-gta-6-which-are-actually-malware-circulating-on-piracy-sites-branded-as-cyberleek.1609483/)
- [Fast, Broad, and Elusive: How Vidar Stealer 2.0 Upgrades Infostealer Capabilities](https://www.trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html)
- [Vidar Stealer: Malware Evolution & Acronis Defenses](https://www.acronis.com/en/tru/threat-catalog/malware/infostealers/vidar/)
- [Vidar Malware: How the Multithreaded Windows Stealer Works](https://www.picussecurity.com/resource/blog/vidar-malware-how-the-multithreaded-windows-stealer-works)
- [Web Service: Dead Drop Resolver, Sub-technique T1102.001 - Enterprise](https://attack.mitre.org/techniques/T1102/001/)
- [C2 powered by Steam](https://intelinsights.substack.com/p/c2-powered-by-steam)
- [The other GTA VI lure - a ClickFix loader that leaked its own C2](https://medium.com/@devmihaylov/the-other-gta-vi-lure-a-clickfix-loader-that-leaked-its-own-c2-871998f8e89d)
- [Rockstar Games Confirms GTA 6 Leak; Hacker Identified As Lapsus$ Member](https://www.lowyat.net/2022/284718/rockstar-games-confirms-gta-6-leak-hacker-lapsus/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2132