GTA 6 Has No Demo. The Site Offering One Has Malware
Grand Theft Auto VI does not have a demo. It has never had one. That has not stopped a small network of websites from selling one, and at least one hands out an infostealer instead of a game.
Malwarebytes traced the download to a working infostealer
Researchers at Malwarebytes found the campaign running under domains built to read as official: gta6demo.eu, gta6demo.us, gta6demo.asia, and rockstar-gta-6.com. The pages surface in ordinary Google searches next to real GTA 6 coverage, styled in Rockstar's colour scheme, with a "Play Now" button standing where a store listing would put "Buy Now."
Click it and the site serves gta6_installer.exe, all of 1.1 MB. That size alone should stop anyone who thinks about it for a second: a current-generation open-world game does not ship in a file smaller than a phone photo. Malwarebytes identified the executable as a build of Vidar, an infostealer sold to other criminals as a subscription service. No fake CAPTCHA, no browser extension prompt, no second step. The download is the entire attack.
What Vidar actually takes
Vidar's job is reading what your browser already remembers. Malwarebytes' sample checked 19 browsers, including Chrome, Edge, Firefox, Brave, Opera and Vivaldi, and pulled saved passwords, browsing history, FTP credentials and active session cookies.
Stolen session cookies are worse than stolen passwords in one specific way: they can let someone walk into an account that is already logged in, skipping the password and the two-factor prompt entirely. TechCrunch's reporting on the same sample makes the same point, and GBHackers' writeup independently confirms the 19-browser target list. Three outlets, one shared sample, no daylight between the accounts.
Malwarebytes first captured the sample on 19 August, the day after the CyberLeek gameplay leak started circulating. That timing is not a coincidence. A game trending in search results for the wrong reasons is exactly when a fake download page earns its clicks.
We flagged this risk before it had a name
Our own coverage of the August leak said plainly that a "GTA 6 full map download" was, at the time, among the most attractive lures on the internet for malware distribution, in the post explaining why we don't link leaked material. This is that prediction with a domain name and a file hash attached to it.
The pattern repeats every time a hyped release nears launch, and it narrows to the same handful of tells: an implausible file size for the genre, a domain nobody official has ever mentioned, and a "Play Now" button standing in for an actual storefront listing.
The only legitimate release this week is footage, not a demo
Rockstar's actual release this week is not a playable build. Grand Theft Auto VI: An Extended Look premieres on Netflix at 3 p.m. ET on 27 August, then goes up free on Rockstar's YouTube channel and the official GTA VI site six hours later. Rockstar's own announcement frames it as footage, and nothing beyond that.
Any site promising you can install and play GTA 6 before that date, on any platform, is lying by definition. The only thing Rockstar has scheduled for release before 19 November is a video.
Three checks catch nearly all of this
Look at the actual domain, not the display text. Gta6demo.eu and rockstar-gta-6.com are not Rockstar properties, and no hyphenated knock-off of a publisher's name ever is. Check the file size against the genre: anything claiming to be a modern open-world game at a few megabytes is not that game. And treat "early access," "leaked build" and "official download" as the same warning sign wearing three outfits, whether the phrase turns up in a leak's manifesto or a search ad.
If you already ran the installer, Malwarebytes' advice is to change your passwords from a clean device, sign out of active sessions everywhere your accounts allow it, and run a scan rather than assume nothing happened because nothing looked wrong.
November 19 has not moved. Everything currently confirmed about the game lives on one page we keep up to date, and the editions breakdown covers what an actual purchase gets you, now that preorders and platform storefronts are the only channels that exist.