GTA 6 Malware Spikes As NordVPN Exposes Fake Preorder Scams

Scammers are taking advantage of the immense hype surrounding the upcoming launch of Grand Theft Auto VI with fake websites targeting potential victims. These sites dangle exclusive beta keys and pre-release installers that do not actually exist, according to NordVPN's Threat Intelligence team. These and other related malware traps are flooding the internet ahead of the game's release this November.

"GTA VI is one of the most anticipated releases in gaming history, and that level of public excitement is exactly what criminals look for," says Marijus Briedis, CTO at NordVPN. "When people are desperate to get early access to something, their guard comes down. That's the window attackers exploit."

It did not help that an internal Best Buy email referencing GTA VI preorders found its way to the web at large, sparking speculation that one of the most anticipated video games of all time would soon be available to purchase early. This prompted opportunistic scammers to pounce.

According to the report, threat actors have been capitalizing on the hype by deploying fake installers, Android adware, and phishing pages targeting both PC and mobile users, even though GTA VI is confirmed to be a console-only title at launch. A PC port will undoubtedly come at some point, but there has been no indication that it will release at the same time as GTA VI arrives on console.

Fake early access site for GTA VI (Source: NordVPN via Notebookcheck)

"NordVPN identified multiple scam sites promising exclusive beta keys for PS5 and Xbox Series consoles. The mechanics are straightforward but effective: users fill out a short form, are then funneled through a bot-verification step, and are directed to subscribe to paid services or download potentially unwanted applications (PUAs). By targeting PC and mobile users with promises of console beta access, scammers exploit both curiosity and FOMO," the report states.

These malicious campaigns are wide ranging, with attacks spanning DLL sideloading trojans hidden inside fake game repacks, to supposed "GTA 6 Beta" releases that are actually nothing more than Android adware.

According to the NordVPN's report, some of the scam sites are convincing. In one instance, a site distributes what looks like a legitimate game installer, but once executed on a PC, a hidden malicious file disguised as an NVIDIA graphics driver component runs in the background to infect the system with malware. It then modifies the system's memory to download more malware and connect to external servers for further instructions.

The full report is available to view at Notebookcheck (scroll down to the bottom) and is worth a read. Bottom line is, if preorders happen, wait for official confirmation from Rockstar Games and its retail partners.

Grand Theft Auto VI remains on track to launch on November 19, 2026.