Grand Theft Auto 6 won’t be released until November 19th, but the hype is already huge. Unsurprisingly, scammers are already using the buzz to flood the web with fake copies of the game. Researchers have now taken apart one of those “leaked” downloads – and it’s nasty.

According to security researchers at Huntress, threat actors are posting massive fake game files – some bloated to more than 100GB just to look like a real AAA download – to gaming forums, social media, and torrent sites as an initial access lure.

Moreover, the scammers are employing SEO poisoning techniques to manipulate these fakes into ranking highly in search results.

Huntress says it has seen several examples of SEO poisoning designed to rank highly in searches for GTA 6, as well as ISOs (digital disk image files) published on gaming forums, social media, and various torrenting sites.

Researchers decided to analyze an ISO file masquerading as a leaked version of GTA 6 found in a sandbox. The package includes a fake installer, several RATs, an infostealer, ransomware being used as a wiper, and a web browser.

Based on the language in the initial prompts and eventual ransom note, the malware appears to be targeting Russian gamers, Huntress said in a blog post.

Here’s what happens if the crooks successfully fool someone:

• When you try to install a fake game file, you get a message (in Russian) warning that the “crack” might not work and to email the scammers if it breaks. That’s a setup designed to make what happens next seem normal. Needless to say, the email isn’t responsive.
• Instead of a game, the install secretly plants tools that let the attacker spy on you by accessing your webcam, logging keystrokes, and stealing passwords from browsers. They also pilfer your Discord, Roblox, and Minecraft accounts.
• Worst part: the fake install also drops ransomware, except the attackers never actually ask for money. They just destroy your files and slap a taunting SpongeBob wallpaper on your desktop, saying you’ve been hacked by the “Asha Hacker Team.”
• To keep the scam alive, the installer finishes by throwing up a fake “license not found” error, so you just think the crack didn’t work, while actually, the malware still runs quietly in the background.

According to Huntress, this particular attack vector is a prime example of how scammers exploit gaming hype cycles – leaked footage, the Netflix extended look, and release-date anticipation – to trick impatient fans.

“It’s not a good idea to attempt to download cracked, pirated software, especially if the game in question has not yet been released. This is fertile ground for scams and threat actors attempting to take advantage of the impatient and overeager,” the cybersecurity firm said.

The consolation in this case is that nothing in this particular fake ISO is relatively novel. The malware within is several years old, and a currently updated version of Windows Defender can detect and stop it from compromising the system.

Still, if you do install malware, Huntress advises disconnecting the machine from the network, resetting all your passwords, enabling 2FA wherever possible, and performing a complete reimage of the compromised system.

Another fake GTA 6 ISO began circulating on the web a few weeks ago. Inside, a virus was hiding, and everything else was mostly junk data.