# Fake GTA 6 PC download delivers WARDEN Stealer (Steam, Roblox, browser and crypto wallet data theft)

> Cynet researchers, as reported by Help Net Security on 2026-11-13, found a fake 'GTA 6 EXE file download' lure, linked from a Google Colab notebook, that leads to a fake 'Windows Software Hub' page serving a ZIP with a 796 KB WARDEN Stealer loader. The malware steals saved passwords, browser cookies, Steam/Roblox credentials and crypto wallet data, hijacks clipboard crypto addresses and can download further malware.

- **Published:** 2026-11-13T15:23:56Z
- **Last reviewed:** 2026-11-13T15:23:56Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5970
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5970.png
- **ID:** TL-2026-5970
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (3 shown free below)

## Description

Campaign (per Help Net Security reporting Cynet research, 2026-11-13): A Google Colab notebook promotes a 'GTA 6 EXE file download'. The link leads to a page styled as 'Windows Software Hub' showing a version number, a download count, and 'Virus Free', 'Secure' and 'Verified' badges, and advertising a 72 MB download. The download is a ZIP archive holding a 796 KB executable and a 1 KB README. The executable contains no game engine, game assets or Rockstar signatures; it is a WARDEN Stealer loader. The README tells the victim to run the file as administrator, click past the security warning, and add an antivirus exclusion if the file is blocked. The lure is time-sensitive: the article notes GTA VI launches on November 19 and that no PC version exists.

Observed behavior (campaign sample, per the article): theft of saved passwords, browser cookies, Steam and Roblox credentials and cryptocurrency wallet data; virtual-machine/sandbox checks; code injection into browser processes; replacement of cryptocurrency addresses copied to the clipboard (clipper); and the ability to download additional malware. Cynet's probable C2 domain is uroker.casa. Cynet also listed 104.21.75.176, a shared Cloudflare IP that the article advises against blocking, because blocking it risks collateral impact on unrelated sites. Cynet published SHA-256 hashes for the executable and README, but the article does not reproduce them and the original Cynet report was not located, so they are not included here. The article does not describe persistence or attribute the campaign to a named actor.

Family context (separate reporting, not specific to this lure): WARDEN Stealer (also 'WardenStealer'; tracked by Gen Digital as CallbackBeaver) is a Rust-written Windows stealer, clipper and loader sold as malware-as-a-service on Russian-language forums (Exploit, XSS). Gen Digital places the first builds in early May 2026, with public promotion from August 2026; SpyCloud first saw it on 2026-08-03 and has ingested 130,000+ infections; v1.9 (2026-09-29) folded AI-agent token collection into the standard build. KrakenLabs-sourced reporting (2026-07-24, vendor-claimed and unverified) describes 500-600 KB 64-bit builds, 330+ targeted desktop apps, 200+ wallet extensions, a custom encrypted binary C2 protocol with Cloudflare-backed gates and failover, and geofencing that excludes CIS and Baltic victims. Gen-derived technical analysis (2026-10-09) describes in-memory reconstruction and injection (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) into the shell process (earlier builds: msiexec.exe, dllhost.exe), a Base64-like build-specific alphabet, large PE-overlay padding, VM detection against VMware/VirtualBox/KVM/Xen/QEMU, a Chromium App-Bound Encryption bypass via injecting a stub into the browser and calling CryptUnprotectMemory to recover the v20 master key, and use of certutil.exe to fetch extra payloads to the temp directory. Because the service is MaaS, each operator uses its own builds and C2; the domain and hash IOCs below taken from family reporting are not confirmed to belong to the GTA 6 campaign. A BeaconBeagle lookup for uroker.casa and 104.21.75.176 returned HTTP 502 and could not be completed.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1497.001 System Checks
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**WARDEN Stealer: Remote Thread Injection into Browser, msiexec or dllhost** (`TL-2026-5970-SPL-002`)

Detects process injection by a user-path process into Chromium/Gecko browsers or the msiexec.exe and dllhost.exe hosts, the technique WARDEN Stealer uses to bypass Chromium App-Bound Encryption (CryptUnprotectMemory) and steal saved passwords and session cookies (TL-2026-5970).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1055, T1555.003, T1539
- **Data sources:** sysmon, defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=8 earliest=-24h TargetImage IN ("*\\chrome.exe","*\\msedge.exe","*\\brave.exe","*\\opera.exe","*\\firefox.exe","*\\msiexec.exe","*\\dllhost.exe") (SourceImage="*\\Users\\*" OR SourceImage="*\\ProgramData\\*" OR SourceImage="*\\Temp\\*") NOT SourceImage IN ("*\\Google\\Chrome\\*","*\\Microsoft\\Edge\\*","*\\Mozilla Firefox\\*","*\\BraveSoftware\\*")
| stats count min(_time) as first_seen max(_time) as last_seen values(TargetImage) as targets values(StartFunction) as start_function by host, SourceImage
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("CreateRemoteThreadApiCall", "QueueUserApcRemoteApiCall", "NtMapViewOfSectionRemoteApiCall")
| where FileName in~ ("chrome.exe", "msedge.exe", "brave.exe", "opera.exe", "firefox.exe", "msiexec.exe", "dllhost.exe")
| where InitiatingProcessFolderPath has_any (@"\Users\", @"\ProgramData\", @"\Temp\")
| where InitiatingProcessFolderPath !has_any (@"\Google\Chrome\", @"\Microsoft\Edge\", @"\Mozilla Firefox\", @"\BraveSoftware\")
| project Timestamp, DeviceName, ActionType, InjectorProcess = InitiatingProcessFolderPath, InjectorSHA256 = InitiatingProcessSHA256, TargetProcess = FileName, InitiatingProcessAccountName
| order by Timestamp desc
```

### Sigma

```yaml
title: WARDEN Stealer Remote Thread Injection into Browser or msiexec/dllhost
id: 7a2d9e44-1b3c-4f58-8c6d-0e91b5f4d002
status: experimental
description: Detects CreateRemoteThread from a user-writable-path process into a browser, msiexec.exe or dllhost.exe. WARDEN Stealer (CallbackBeaver) injects into browsers to bypass Chromium App-Bound Encryption and recover v20 keys for passwords and cookies, and earlier builds injected into msiexec.exe and dllhost.exe.
references:
    - https://www.helpnetsecurity.com/2026/11/13/fake-gta-6-download-scam/
    - https://cybersecuritynews.com/warden-stealer/
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.defense-evasion
    - attack.t1055
    - attack.credential-access
    - attack.t1555.003
    - attack.t1539
logsource:
    category: create_remote_thread
    product: windows
detection:
    selection_target:
        TargetImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\brave.exe'
            - '\opera.exe'
            - '\firefox.exe'
            - '\msiexec.exe'
            - '\dllhost.exe'
    selection_source:
        SourceImage|contains:
            - '\Users\'
            - '\ProgramData\'
            - '\Temp\'
    filter_browser:
        SourceImage|contains:
            - '\Google\Chrome\'
            - '\Microsoft\Edge\'
            - '\Mozilla Firefox\'
            - '\BraveSoftware\'
    condition: selection_target and selection_source and not filter_browser
falsepositives:
    - Browser updaters and per-user installed security or accessibility software
    - Debuggers and game anti-cheat overlays injecting into browsers
level: high

```

**Known false positives:**

- Per-user installed software (overlays, accessibility tools, password managers) that injects into browsers
- Security products or debuggers run from user profile directories

**Tuning notes:** Requires Sysmon EventCode 8 (CreateRemoteThread). Add the SourceImage of approved per-user tools to the NOT clause, and consider alerting only when the source binary is unsigned or was created within the last 24 hours.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Fake GTA 6 Executable Launched from Download or Archive Path (WARDEN Loader Lure) (locked: unlock with TL Creds)
- WARDEN Stealer: Sandbox and VM Detection Commands from User-Path Process (locked: unlock with TL Creds)
- WARDEN Stealer: [indicator] Log Staging Artifact (locked: unlock with TL Creds)
- WARDEN Stealer C2 Domain DNS Resolution ([indicator] and Family Domains) (locked: unlock with TL Creds)
- WARDEN Stealer: Argument-less msiexec/dllhost Injection Host Spawned from User Path (locked: unlock with TL Creds)
- WARDEN Stealer: certutil Writes Executable Payload to Temp (locked: unlock with TL Creds)
- WARDEN Stealer: User-Run EXE from Download/Archive Followed by Defender Exclusion (locked: unlock with TL Creds)
- WARDEN Stealer: certutil Payload Download and C2 Domain DNS Resolution (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 22)

Defanged, TLP:CLEAR.

- IP address: `104.21.75[.]176`
- Domain: `uroker[.]casa`
- File hash: `006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Fake GTA 6 download goes after Steam logins and crypto wallet data (Help Net Security, reporting Cynet research)](https://www.helpnetsecurity.com/2026/11/13/fake-gta-6-download-scam/)
- [Warden Stealer Spreads Through ClickFix, Malvertising, Cracked Software and Game Cheats (Cyber Security News)](https://cybersecuritynews.com/warden-stealer/)
- [New WARDEN Stealer Targets 330+ Apps and 200 Crypto Extensions on Windows (Cyber Press, citing KrakenLabs)](https://cyberpress.org/new-warden-stealer-targets-330-apps/)
- [IntelStealers: the infostealers going after AI tokens and AI configuration data (SpyCloud)](https://spycloud.com/blog/infostealers-now-target-ai-tokens-and-api-keys/)
- [Warden Stealer Rust Infostealer Hits AI Coding Agents (SecurityOnline)](https://securityonline.info/warden-stealer-rust-infostealer/)
- [Fake GTA 6 Extended Look and demo sites deliver an infostealer (Malwarebytes; related GTA 6 lure, different campaign)](https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-gta-6-extended-look-and-demo-sites-deliver-an-infostealer)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5970