Malware posing as playable copies of Grand Theft Auto 6 has been spotted online in non-trivial numbers for the first time ever. While the game is still months away from release, the timing is not accidental but rather a direct result of the still-ongoing barrage of GTA 6 leaks that has been spreading online in late August 2026.
The person or group responsible for the latest drama, CyberLeek, has consistently framed its activities as “fighting for gamers” by protesting some of Rockstar’s business practices. Its since-pulled “Edict” railed against digital preorders, paid unlocks for single-player content already present in day-one game files, and publishers rendering single-player games inaccessible after shutting down their servers. However, that consumer-rights framing has been accompanied by some conspicuously commercial ventures, as CyberLeek leveraged it to promote the launch of its cryptocurrency and more recently even offered to sell ad space on future GTA 6 leaks.
GTA 6 Malware Is Capitalizing on the CyberLeek Chaos
A number of piracy sites have seen an influx of downloads claiming to contain playable GTA 6 builds in late August 2026. While virtually every high-profile game has its name used in such scams, what makes this latest trend notable is that CyberLeek’s brazen sharing of GTA 6 footage stirred up enough chaos to lend the claims more credibility than they would ordinarily have. According to NordVPN CTO Marijus Briedis, every single instance of GTA 6 making headlines is followed by leaked footage being (re)shared online via Discord, mirror sites, and re-uploads on mainstream sites. He identified that as “exactly the environment where fake ‘leak’ downloads and credential-harvesting pages thrive,” having said as much in a recent statement to IGN.
