TLDR InfoSec · MISCELLANEOUS

GRAND THEFT AUTO VI HYPE LEADS TO MALWARE

huntress.com5 min read

Summary from the TLDR InfoSec newsletter

Fake "leaked GTA6" ISOs spread through SEO poisoning, gaming forums, and torrent sites deliver a Russian-language installer that pre-warns of a "License not found" error, giving victims a reason for the missing game while payloads drop into %TEMP%. Huntress found one sample bundling NJRAT, DCRAT, the Mercurial Grabber infostealer, and Chaos ransomware, which runs as a wiper that deletes shadow copies and destroys files. Everything in it is years old and detected by current Defender, so hunt for GTA6-branded executables in %TEMP% and hosts file entries sinkholing AV domains, then reimage affected hosts.