Skip to content

Leonidash has a Discord — news, map corrections, and launch night.

Join
Explainer··8 min read

GTA 6 scams: there is no demo, no beta and no early access — and the "installer" is 1.1 MB

Local television in Miami warned about fake Grand Theft Auto VI early-access offers on 18 October. Rockstar has released no demo, no beta and no PC build, preload does not open until 12 November, and the file sold as a GTA 6 installer is 1.1 MB of password-stealing malware. What exists, what cannot, and what to do if you ran one.

A lit causeway of traffic running between islands at dusk, moored boats on the water either side and a city skyline on the horizon.
Image: Rockstar Games · GTA VI Trailer 1, 00:32

CBS News Miami ran a consumer segment on 18 October warning viewers about fake Grand Theft Auto VI early-access offers, a month before launch. That a local television station is now covering it is the news; the scams themselves have been running since the summer, and they are all built on the same assumption — that someone who has waited thirteen years will not check whether the thing being sold can exist.

It cannot. There is no GTA VI demo, no beta, no early access and no PC build. Not restricted, not regional, not leaked-but-working. The entire catalogue of ways to play Grand Theft Auto VI before 19 November is empty, and it has been empty every day the game has existed.

That single fact disposes of every offer in this article. The rest is detail about how the fakes are dressed.

What Rockstar has actually released

Status
Playable demoDoes not exist. Never announced, never released
Public or closed betaDoes not exist. Never announced
Paid early accessDoes not exist. Never announced, at any price, on any platform
PC versionNot at launch. No date and no specification
Preload, PS5 and Xbox Series X|S12 November, local midnight, digital pre-orders and redeemed codes
The game itself19 November, console only

Two rows do the work. Preload is the earliest legitimate download of any part of this game, and it is a week before release — not a month, and not available now. And a preloaded copy is encrypted on the drive until the unlock; even the real files, legitimately obtained, do not run early.

So the question to put to any offer is not whether it looks convincing. It is which of those six rows it claims to have beaten.

The size is the tell

The most useful single number in this story is not a price. It is a file size.

Malwarebytes traced the first malicious sample in the fake-demo campaign to 19 August, an executable named gta6_installer.exe. It is 1.1 megabytes.

Grand Theft Auto VI is a game Rockstar has not published an install size for, and which we have argued should be planned for at around 250 GB on the evidence of Red Dead Redemption 2 and GTA V. The boxed copy contains a download code rather than a disc precisely because the thing will not fit on one.

A 1.1 MB download is roughly two hundred thousandth of that. It is smaller than one high-resolution screenshot from the game's own press kit. Whatever it is, it is not Grand Theft Auto VI, and no amount of "it downloads the rest after install" makes the arithmetic work — a real installer stub would still have to pull 250 GB from somewhere, at which point you would be watching a week-long download, not playing.

If a GTA VI download completes in under a minute, it is not GTA VI. That test needs no security knowledge and no judgement about how official a website looks.

What the files actually do

Malwarebytes' August research describes a network of sites impersonating Rockstar and surfacing in searches for a GTA 6 demo. They copied the real promotional pages for the Extended Look closely; the reported difference was the button, where the genuine page offers a video and the fake offers Play Now.

The payload is Vidar, an infostealer sold as a service to other criminals. What it takes:

  • Saved passwords from browsers
  • Session cookies — the tokens that keep you signed in
  • Browsing history and autofill data, which is where card details and addresses live

The session cookies matter more than the passwords. A stolen, still-valid session token lets someone resume an account you are already logged into without the password and without the second factor, because the authentication already happened. Two-factor authentication does not help against a cookie that was issued after the second factor was satisfied.

A second, simpler variety has run alongside it. Earlier in the year Malwarebytes documented sites selling "VIP early access" outright, payable in cryptocurrency — reported at the time by PC Gamer, which quoted the firm's description of GTA VI as near-perfect bait. There is no malware in that one and no download either. It is a straightforward payment for nothing, in a currency with no chargeback.

The four shapes it takes

The offerWhy it is impossible
A playable demo or "Extended Look" downloadRockstar's Extended Look is a video. There has never been a playable build outside Rockstar
Paid early access, often in cryptocurrencyNo such product exists at any price. Crypto is chosen because the payment cannot be reversed
Beta keys or a tester programmeNo beta has been announced. There is nothing to hold a key to
A PC build, cracked or otherwiseThere is no PC version yet. A crack requires something to crack

The fourth is the one worth dwelling on, because it is the only category where the usual piracy reasoning fails completely. A pirated copy of a console game that has not shipped, for a platform the game has not been built for, is not a hard thing to obtain. It is not a thing.

If you ran one

Treat it as a credential compromise rather than a virus, because that is what it is. The malware's job was finished in seconds, and removing it afterwards does not un-steal anything.

  1. Assume every password saved in that browser is gone, and every account you were signed into on that machine.
  2. Change the important passwords from a different, clean device — email first, because it is the reset route into everything else. Changing them on the infected machine simply donates the new ones.
  3. Sign out of all sessions everywhere. Most major services have a "sign out of all devices" control, and this is what it is for. Until you do, a new password does not evict anyone holding a live cookie.
  4. Run a full scan, and treat the machine as untrusted until it is clean.
  5. If you paid, tell the bank. Card payments can sometimes be reversed. Cryptocurrency cannot, and anyone offering to recover it for a fee is the second scam.

Where the real thing will come from

Every genuine announcement about this game has appeared in one of three places: the Rockstar Newswire, Rockstar Support, and the PlayStation and Xbox store listings. Nothing has ever been announced to an individual by direct message, in a reply to a post, or in a paid advertisement on a social network.

That is the whole verification procedure. If an offer did not come from one of those three, it did not come from Rockstar — and if it claims something that contradicts the table at the top of this page, no amount of official-looking branding changes what it is.

The game is a month away. The pre-order is the only transaction available, and the editions differ in bonus content rather than in access: there is no tier that starts early. If you want something to look at in the meantime, everything Rockstar has actually shown of the state is public, free, and collected in our regions index — which is a genuinely poor substitute for playing it, and still infinitely better than a 1.1 MB executable.

What is not confirmed

  • That Rockstar has responded to any of this. It has published no Newswire post and no support notice about the scam wave. The warnings are coming from security firms and from consumer journalism, not from Rockstar.
  • How many people have been hit, or how much has been taken. No figure from law enforcement or from a platform exists. Anyone quoting one is estimating.
  • That the campaigns described here are the only ones running. They are the ones that have been documented. New domains are cheap.
  • The install size, which is still unannounced — so the 250 GB used above for comparison is our planning figure, not Rockstar's.
  • Anything about a PC release, including whether a build exists to steal. Still no date.

The one line worth keeping

There is nothing to download before 12 November, nothing to play before 19 November, and nothing on PC at all. Every offer that contradicts any part of that sentence is false, and you do not need to work out which kind of false it is before closing the tab.

Sourcing note: cbsnews.com, rockstargames.com, malwarebytes.com, pcgamer.com, eurogamer.net, videogameschronicle.com, gamesradar.com, gamespot.com and kotaku.com are all refused by this writer's network, so none of the reporting described here was read first-hand. The CBS News Miami segment of 18 October, the Malwarebytes research of August on the fake demo sites, and the earlier Malwarebytes work on paid "VIP early access" sites as PC Gamer reported it, are carried as search results from those outlets described them, concordantly: the 19 August first sample, the gta6_installer.exe name, the 1.1 MB size, the Vidar payload and the categories it harvests were reported identically across several independent write-ups. The named researcher credited with the demo-site work in one account could not be corroborated in another and is therefore not named here. Specific scam domains reported by one security outlet are deliberately omitted. No figure in this article comes from Rockstar, which has published nothing on the subject; the claims about what Rockstar has not released are from the absence of any announcement, which is checkable on the Newswire. The 250 GB comparison is this site's own planning figure and is labelled as such.