GTA VI leaks via fake CyberLeek site

Published August 26, 2026

Scammers are using the buzz around the real GTA VI leaks to spread malware. Fake download sites, torrent files, and impersonator Telegram and Discord channels promise a leaked GTA VI build or demo, but actually install infostealers or malware that disables Windows security software.

Report priority
Medium

How it works

Attackers build fake torrent files and websites that copy the branding and hype around the CyberLeek GTA VI leaks or Rockstar's official Extended Look, then bundle the download with hidden malware instead of any real game files.

What to do

There is no legitimate public GTA VI download, demo, or playable build right now, so anyone who ran a file or installer claiming to be one should assume it may be malicious.

Do not download files from torrent sites, visit sites, or join Telegram or Discord channels claiming to offer a GTA VI build or demo. If you already ran one, run a full antivirus scan and change any passwords stored in your browser.

Technical details

A GTA VI fan downloads a multi gigabyte torrent file advertised as the complete leaked game. The file turns out to be mostly blank padding wrapped around a small piece of malware built to disable Windows security software once it runs. Other fans visit a fake site promising a GTA VI demo or preview, which instead installs infostealer malware that quietly copies saved passwords and browser session data. Separate Telegram and Discord channels impersonate CyberLeek itself, offering a downloadable playable build that the real CyberLeek has never actually released.

The malicious files documented so far fall into two types. One is a large torrent download that is almost entirely padding data hiding a small payload capable of disabling Windows Defender or similar security tools. The other is browser-based infostealer malware served from fake preview or demo sites, designed to harvest saved credentials and active browser session data rather than to spread on its own. Telegram and Discord accounts impersonating CyberLeek add a social layer, promising a downloadable build that does not exist to drive traffic to these malicious files.

References

View Original Source