Fake GTA 6 PC download delivers WARDEN Stealer (Steam, Roblox, browser and crypto wallet data theft)

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5970 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: WARDEN Stealer: Remote Thread Injection into Browser, msiexec or dllhost

Detects process injection by a user-path process into Chromium/Gecko browsers or the msiexec.exe and dllhost.exe hosts, the technique WARDEN Stealer uses to bypass Chromium App-Bound Encryption (CryptUnprotectMemory) and steal saved passwords and session cookies (TL-2026-5970).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1055, T1555.003, T1539
• Data sources: sysmon, defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=8 earliest=-24h TargetImage IN ("*\\chrome.exe","*\\msedge.exe","*\\brave.exe","*\\opera.exe","*\\firefox.exe","*\\msiexec.exe","*\\dllhost.exe") (SourceImage="*\\Users\\*" OR SourceImage="*\\ProgramData\\*" OR SourceImage="*\\Temp\\*") NOT SourceImage IN ("*\\Google\\Chrome\\*","*\\Microsoft\\Edge\\*","*\\Mozilla Firefox\\*","*\\BraveSoftware\\*")
| stats count min(_time) as first_seen max(_time) as last_seen values(TargetImage) as targets values(StartFunction) as start_function by host, SourceImage
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("CreateRemoteThreadApiCall", "QueueUserApcRemoteApiCall", "NtMapViewOfSectionRemoteApiCall")
| where FileName in~ ("chrome.exe", "msedge.exe", "brave.exe", "opera.exe", "firefox.exe", "msiexec.exe", "dllhost.exe")
| where InitiatingProcessFolderPath has_any (@"\Users\", @"\ProgramData\", @"\Temp\")
| where InitiatingProcessFolderPath !has_any (@"\Google\Chrome\", @"\Microsoft\Edge\", @"\Mozilla Firefox\", @"\BraveSoftware\")
| project Timestamp, DeviceName, ActionType, InjectorProcess = InitiatingProcessFolderPath, InjectorSHA256 = InitiatingProcessSHA256, TargetProcess = FileName, InitiatingProcessAccountName
| order by Timestamp desc

Sigma

title: WARDEN Stealer Remote Thread Injection into Browser or msiexec/dllhost
id: 7a2d9e44-1b3c-4f58-8c6d-0e91b5f4d002
status: experimental
description: Detects CreateRemoteThread from a user-writable-path process into a browser, msiexec.exe or dllhost.exe. WARDEN Stealer (CallbackBeaver) injects into browsers to bypass Chromium App-Bound Encryption and recover v20 keys for passwords and cookies, and earlier builds injected into msiexec.exe and dllhost.exe.
references:
    - https://www.helpnetsecurity.com/2026/11/13/fake-gta-6-download-scam/
    - https://cybersecuritynews.com/warden-stealer/
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.defense-evasion
    - attack.t1055
    - attack.credential-access
    - attack.t1555.003
    - attack.t1539
logsource:
    category: create_remote_thread
    product: windows
detection:
    selection_target:
        TargetImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\brave.exe'
            - '\opera.exe'
            - '\firefox.exe'
            - '\msiexec.exe'
            - '\dllhost.exe'
    selection_source:
        SourceImage|contains:
            - '\Users\'
            - '\ProgramData\'
            - '\Temp\'
    filter_browser:
        SourceImage|contains:
            - '\Google\Chrome\'
            - '\Microsoft\Edge\'
            - '\Mozilla Firefox\'
            - '\BraveSoftware\'
    condition: selection_target and selection_source and not filter_browser
falsepositives:
    - Browser updaters and per-user installed security or accessibility software
    - Debuggers and game anti-cheat overlays injecting into browsers
level: high

Known false positives:

• Per-user installed software (overlays, accessibility tools, password managers) that injects into browsers
• Security products or debuggers run from user profile directories

Tuning notes: Requires Sysmon EventCode 8 (CreateRemoteThread). Add the SourceImage of approved per-user tools to the NOT clause, and consider alerting only when the source binary is unsigned or was created within the last 24 hours.

• 🔒 Fake GTA 6 Executable Launched from Download or Archive Path (WARDEN Loader Lure) · unlock with TL Creds
• 🔒 WARDEN Stealer: Sandbox and VM Detection Commands from User-Path Process · unlock with TL Creds
• 🔒 WARDEN Stealer: [indicator] Log Staging Artifact · unlock with TL Creds
• 🔒 WARDEN Stealer C2 Domain DNS Resolution ([indicator] and Family Domains) · unlock with TL Creds
• 🔒 WARDEN Stealer: Argument-less msiexec/dllhost Injection Host Spawned from User Path · unlock with TL Creds
• 🔒 WARDEN Stealer: certutil Writes Executable Payload to Temp · unlock with TL Creds
• 🔒 WARDEN Stealer: User-Run EXE from Download/Archive Followed by Defender Exclusion · unlock with TL Creds
• 🔒 WARDEN Stealer: certutil Payload Download and C2 Domain DNS Resolution · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-5970.

Sample indicators (3 of 22)

• IP address: 104.21.75[.]176
• Domain: uroker[.]casa
• File hash: 006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c

Defanged, TLP:CLEAR. Full set of 22 indicators: unlock with TL Creds.

Technical analysis

The malware steals saved passwords, browser cookies, Steam/Roblox credentials and crypto wallet data, hijacks clipboard crypto addresses and can download further malware.

Campaign (per Help Net Security reporting Cynet research, 2026-11-13): A Google Colab notebook promotes a 'GTA 6 EXE file download'. The link leads to a page styled as 'Windows Software Hub' showing a version number, a download count, and 'Virus Free', 'Secure' and 'Verified' badges, and advertising a 72 MB download. The download is a ZIP archive holding a 796 KB executable and a 1 KB README. The executable contains no game engine, game assets or Rockstar signatures; it is a WARDEN Stealer loader. The README tells the victim to run the file as administrator, click past the security warning, and add an antivirus exclusion if the file is blocked. The lure is time-sensitive: the article notes GTA VI launches on November 19 and that no PC version exists.

Observed behavior (campaign sample, per the article): theft of saved passwords, browser cookies, Steam and Roblox credentials and cryptocurrency wallet data; virtual-machine/sandbox checks; code injection into browser processes; replacement of cryptocurrency addresses copied to the clipboard (clipper); and the ability to download additional malware. Cynet's probable C2 domain is uroker.casa. Cynet also listed 104.21.75.176, a shared Cloudflare IP that the article advises against blocking, because blocking it risks collateral impact on unrelated sites. Cynet published SHA-256 hashes for the executable and README, but the article does not reproduce them and the original Cynet report was not located, so they are not included here. The article does not describe persistence or attribute the campaign to a named actor.

Family context (separate reporting, not specific to this lure): WARDEN Stealer (also 'WardenStealer'; tracked by Gen Digital as CallbackBeaver) is a Rust-written Windows stealer, clipper and loader sold as malware-as-a-service on Russian-language forums (Exploit, XSS). Gen Digital places the first builds in early May 2026, with public promotion from August 2026; SpyCloud first saw it on 2026-08-03 and has ingested 130,000+ infections; v1.9 (2026-09-29) folded AI-agent token collection into the standard build. KrakenLabs-sourced reporting (2026-07-24, vendor-claimed and unverified) describes 500-600 KB 64-bit builds, 330+ targeted desktop apps, 200+ wallet extensions, a custom encrypted binary C2 protocol with Cloudflare-backed gates and failover, and geofencing that excludes CIS and Baltic victims. Gen-derived technical analysis (2026-10-09) describes in-memory reconstruction and injection (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) into the shell process (earlier builds: msiexec.exe, dllhost.exe), a Base64-like build-specific alphabet, large PE-overlay padding, VM detection against VMware/VirtualBox/KVM/Xen/QEMU, a Chromium App-Bound Encryption bypass via injecting a stub into the browser and calling CryptUnprotectMemory to recover the v20 master key, and use of certutil.exe to fetch extra payloads to the temp directory. Because the service is MaaS, each operator uses its own builds and C2; the domain and hash IOCs below taken from family reporting are not confirmed to belong to the GTA 6 campaign. A BeaconBeagle lookup for uroker.casa and 104.21.75.176 returned HTTP 502 and could not be completed.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks

Execution

T1204.002 Malicious File

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

Impact

T1657 Financial Theft

defense-impairment

T1685 Disable or Modify Tools

Remediation

Immediate actions

• Do not run any 'GTA 6' EXE/ZIP; no PC version of GTA VI exists
• Block uroker.casa at DNS/proxy; do NOT block 104.21.75.176 outright (shared Cloudflare IP)
• Hunt endpoints for ZIPs from fake software-hub pages and for AV exclusions added shortly after a user-run executable
• If infection is confirmed, isolate the host and reset browser-saved passwords, Steam, Roblox and other credentials from a clean device
• Invalidate browser session cookies and move crypto assets from any exposed wallet; verify clipboard-pasted addresses before sending funds

Workarounds

• Use hardware wallets and confirm full destination address on device to defeat clipboard address swapping
• Enable MFA on Steam, Roblox and exchange accounts

Longer-term hardening

• Deploy EDR with behavioral detection for browser-process injection (CreateRemoteThread/WriteProcessMemory) and execution from temp/download folders
• Alert on certutil.exe downloads and on antivirus exclusion changes
• Restrict local admin rights and application allow-listing for user downloads
• Security awareness on game-launch lures, fake 'Verified/Virus Free' badges and README instructions to disable AV

Affected and fixed versions

• Microsoft — Windows (end-user workstations)
  Vulnerable versions: Windows 7 through Windows 11 (per vendor-claimed WARDEN Stealer compatibility)
• Valve / Roblox Corporation — Steam and Roblox accounts (credentials targeted)
  Vulnerable versions: User accounts on infected hosts
• Various — Chromium and Gecko browsers, cryptocurrency wallet extensions
  Vulnerable versions: Saved credentials, cookies and wallet data on infected hosts

Timeline

• 2026-05-01 Gen Digital places the first WARDEN Stealer builds (tracked as CallbackBeaver) in early May 2026; exact day not stated, date is approximate.
• 2026-07-24 KrakenLabs-sourced reporting (Cyber Press) describes WardenStealer MaaS ads: 64-bit stealer/clipper/loader, 330+ apps, 200+ wallet extensions, USD 349/month plan (vendor claims, unverified).
• 2026-08-03 SpyCloud first observes WardenStealer in its collection; 130,000+ infections ingested since August 2026.
• 2026-09-29 WardenStealer v1.9 announced, folding AI-agent data collection into the standard build.
• 2026-10-09 Cyber Security News publishes Gen-derived technical analysis: injection, ABE bypass, certutil payload fetch, ClickFix/malvertising/cracked-software distribution, hashes and C2 domains.
• 2026-11-13 Help Net Security reports Cynet research on the fake GTA 6 EXE download chain (Google Colab -> Windows Software Hub -> ZIP with WARDEN Stealer loader); probable C2 locked-ioc-16.
• 2026-11-19 GTA VI console launch date cited by the article (no PC version); the lure is expected to stay topical around this date.

Sources cited

• IntelStealers: the infostealers going after AI tokens and AI configuration data (SpyCloud) spycloud.com · Research
• Fake GTA 6 Extended Look and demo sites deliver an infostealer (Malwarebytes; related GTA 6 lure, different campaign) malwarebytes.com · Blog
• Fake GTA 6 download goes after Steam logins and crypto wallet data (Help Net Security, reporting Cynet research) Help Net Security · News · 2026-11-13
• Warden Stealer Spreads Through ClickFix, Malvertising, Cracked Software and Game Cheats (Cyber Security News) cybersecuritynews.com · News · 2026-10-09
• New WARDEN Stealer Targets 330+ Apps and 200 Crypto Extensions on Windows (Cyber Press, citing KrakenLabs) cyberpress.org · News · 2026-07-24
• Warden Stealer Rust Infostealer Hits AI Coding Agents (SecurityOnline) securityonline.info · News

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines

Previous and next in malware

• REF3364 SANSAR: Linux GPU Cryptomining Intrusion Falsifies NVIDIA GPU Telemetry via Malicious NVML Wrapper and ftrace Rootkit Previous report
• Gootloader Malware Disrupted in International Operation (Operation Endgame) After Infecting 25,000+ Computers Next report