Cybersecurity

A Fake GTA 6 ISO Didn’t Install a Game. It Installed a Wiper.

A fake GTA 6 ISO used a believable installer error to cover remote-access malware, browser-data theft, and destructive file wiping. The “License not found” message wasn’t the crack failing. It was there so the victim would stop looking.

Amrutanshu Oct 12, 2026 9 min read

The installer had already told the victim what would happen.

This was an unreleased game, it said. The crack might be unreliable. If the install ended with “License not found,” that was unfortunate but understandable. Write to the supplied address, wait for an update, try again.

Then the error appeared exactly as promised. No game launched. No sprawling Vice City map. Nothing looked wrong beyond the sort of broken-crack story that unofficial software has trained people to accept.

That was the trick. The error was the attacker’s explanation for why the victim should stop looking, while the real installation ran in the background.

This article reconstructs a fake GTA 6 ISO from Huntress’s published analysis. Huntress found the sample in a sandbox. We did not run it ourselves, and every behavior described below comes from that one analyzed sample.

What the fake GTA 6 ISO tried to do to a Windows PC

The GTA 6 lure didn’t need to be technically sophisticated to work. Rockstar’s product page lists Grand Theft Auto VI for PlayStation 5 and Xbox Series X|S, with a November 19, 2026 release date. It lists no Windows release, so a supposedly leaked PC ISO should be a non-starter.

But the lure showed up exactly where someone hunting for it would look: search results, social posts, gaming forums, and torrent sites. Huntress saw SEO poisoning around GTA 6 searches, as well as ISOs promoted on forums and social media. Some were padded past 100 GB with junk data, so an empty image looked about the size people expect from a modern AAA game.

The sample made a poor first impression if you knew where to look. Mounting it revealed gta6installer.exe, but the executable used a GTA V icon. That mismatch is useful evidence, but a rushed icon can be noticed and shrugged off. The fake failure message mattered more, because it turned the missing game into a reason to keep trusting the installer.

The license error was a feature, not a bug

When the installer ran, it showed a Russian-language warning. The game was leaked and unlicensed, it said, might not start, and could show a “License not found” error if the crack had been patched. It gave an email address for a future crack update.

At the end of the installation, a script called find.vbs displayed that same license error on purpose. The installer told the victim which excuse to expect, then delivered it.

Other summaries tend to flatten this into “the installer failed.” But a visible crash invites a closer look, while a license problem in an unofficial, unreleased game is exactly what the user expects to see. The error turns suspicion into a support request.

There’s a grim bit of product design in that. The people behind the ISO never had to build a working fake GTA 6. They only had to make the broken version feel normal long enough for the malware to finish.

One ISO carried several different ways to lose a machine

Huntress described the package as an opportunistic bundle: a fake installer, several remote-access trojans (RATs), an infostealer, a ransomware variant used as a wiper, and a copy of the Yandex Browser. The Russian-language installer and the Yandex bundle led Huntress to suggest the ISO may first have been aimed at Russian-speaking users. The lure itself works in any language.

The package contained multiple NJRAT components and a DCRAT component. These are remote-access tools that give an operator a way to look through a machine, control it, steal data, or install more malware. Huntress saw the NJRAT instances create their own Windows Firewall rules and connect out to remote infrastructure. The rockstargames.exe component that dropped DCRAT also edited the Windows hosts file to block a long list of telemetry and security-reporting domains, including ones used by Malwarebytes, McAfee, Avast, and Trend Micro.

You don’t need every capability of every RAT to understand the risk. A machine that seemed to have a failed game install could now have an operator-shaped hole in it. Credential theft is bad. Credential theft plus the ability to come back later is a different class of incident.

Huntress also found Mercurial Grabber, an infostealer that is freely available on GitHub. It collects Chrome passwords and cookies, Discord tokens, Roblox Studio cookies, Minecraft session data, system information, Windows product keys, and screenshots, and sends the results to a Discord webhook. The list is eclectic because the audience is eclectic. A gaming lure reaches machines whose browser might also hold a personal email session, a payment account, a work app, or a wallet extension.

Not every stolen Discord token turns into a corporate breach. But an infostealer doesn’t need to know which account will matter before it starts collecting. The operator can sort that out later.

Browser sessions are the part people miss

The usual advice after a password stealer is to change your passwords. Do that, but it isn’t the whole job.

Browsers also hold session cookies, the small pieces of data that tell a site you’ve already signed in. Malwarebytes, which analyzed a separate fake GTA 6 campaign, notes that a stolen, still-valid session may let an attacker reuse a login without going through the password and MFA prompt again. Whether that works depends on the service’s controls, which is why changing passwords alone doesn’t contain the damage.

In practice, that means working from a known-clean device. Change sensitive passwords, then use each service’s controls to sign out other devices, revoke sessions, and remove logins you don’t recognize. If recovery codes, authenticator secrets, or a crypto-wallet recovery phrase were stored on the affected PC, treat all of it as exposed: regenerate recovery codes, revoke and re-enroll authenticator secrets where the service supports it, and move any wallet funds to a new wallet from a clean device rather than trying to “replace” a compromised recovery phrase. When you rebuild the machine, don’t restore browser profiles, files, or system backups made after the infection. Those can carry compromised data, or the malware itself, straight back in.

For the broader mechanics, SudoSecurity’s guide to infostealers explains why browser credentials, session cookies, and locally stored secrets stay valuable long after the installer is gone.

Deleting the fake installer undoes none of this. An attacker who has already left with an email session, a wallet secret, or a Discord token doesn’t need persistence.

The wiper made recovery the real emergency

The most damaging payload was a variant of the Chaos ransomware. Huntress didn’t think the operators wanted a ransom. The malware encrypted or destroyed data, which made it a wiper in practice.

In the analyzed sample, this component ran only if the victim’s account had administrator rights. That’s a meaningful condition, but many home PCs run day-to-day under admin accounts, so it’s a thin line of protection. When it did run, it deleted shadow copies, changed boot settings to disable recovery, encrypted files up to 200 MB, and overwrote larger files with random data. It went after non-system drives first, then common user folders, AppData, and OneDrive locations if present.

This is where “I deleted the dodgy installer” falls apart. The victim may be dealing with account recovery and data recovery at the same time. A cloud-sync folder isn’t automatically a backup when destructive changes can sync faster than anyone notices. An external drive plugged in during the install may not be one either.

The wiper also changes the emotional tone of the campaign. The desktop wallpaper was replaced with a SpongeBob image announcing, in Russian, that the machine had been hacked by the “ASHA hacker team.” The read_it.txt note left in each folder didn’t even pretend to negotiate. It said the author had no way to accept payment and that the files were “encrypted forever.” There was no meaningful ransom path, and recovery could be extremely difficult. It just made the machine worse on the way out.

What a real detection signature for this looks like

Threat intelligence doesn’t stay locked inside vendor reports. Researchers publish detection signatures publicly so anyone running endpoint tooling can catch a malware family before it needs a name in a headline. Here’s a real YARA rule, written by security researcher ditekSHen, from the public detection repository:

rule MALWARE_Win_Chaos {
    meta:
        author = "ditekSHen"
        description = "Detects Chaos ransomware"
    strings:
        $s1 = "<EncyptedKey>" fullword wide
        $s2 = "<EncryptedKey>" fullword wide
        $s3 = "C:\\Users\\" fullword wide
        $s4 = "read_it.txt" fullword wide
        $s5 = "#base64Image" fullword wide
        $s6 = "(?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}|bc1[a-z0-9]{39,59})" fullword wide
        $s7 = /check(Spread|Sleep|AdminPrivilage|deleteShadowCopies|disableRecoveryMode|deleteBackupCatalog)/ fullword ascii nocase
        $s8 = /(delete|disable)(ShadowCopies|RecoveryMode|BackupCatalog)/ fullword ascii nocase
        $s9 = "spreadName" fullword ascii
        $s10 = "processName" fullword ascii
        $s11 = "sleepOutOfTempFolder" fullword ascii
        $s12 = "AlreadyRunning" fullword ascii
        $s13 = "random_bytes" fullword ascii
        $s14 = "encryptDirectory" fullword ascii nocase
        $s15 = "EncryptFile" fullword ascii nocase
        $s16 = "intpreclp" fullword ascii
        $s17 = "bytesToBeEncrypted" fullword ascii
        $s18 = "textToEncrypt" fullword ascii
        $m1 = "Chaos is" wide
        $m2 = "Payment informationAmount:" wide
        $m3a = "Coinmama - https://www.coinmama.com Bitpanda - https://www.bitpanda.com" wide
        $m3b = "Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com" wide
        $m4 = "where do I get Bitcoin" wide
    condition:
        uint16(0) == 0x5a4d and
        (
            6 of ($s*) or
            (all of ($m1, $m2, $m4) and 1 of ($m3*)) or
            (2 of ($m*) and 4 of ($s*))
        )
}

Notice what it’s actually looking for: not just a hash or a single filename, but the ransom-note strings (read_it.txt, “Chaos is,” the “where do I get Bitcoin” line), the shadow-copy and recovery-disabling function names, and a string containing a Bitcoin-address-like pattern. This is the same family Huntress found repurposed inside the fake GTA 6 ISO — the rule doesn’t care what installer dropped it. We did not independently run this rule against Huntress’s sample, so this is a family-level detection example rather than a reported match on that ISO.

The good news: none of this is new

For all the damage it could do, the bundle wasn’t sophisticated. Huntress found that much of the malware was several years old, with many files dating back to 2023. In every case, an up-to-date Windows Defender detected the malware and stopped it.

That makes the most dangerous step easy to name. Cracks and “leaked” installers commonly tell users to disable their antivirus or add an exclusion, and they explain away security warnings as false positives caused by the crack. For this sample, following that advice was the difference between a blocked download and a compromised machine. If an installer asks you to turn off your protection first, that request is the warning.

This is a pattern, not a GTA-only problem

The Huntress ISO is one sample. It doesn’t show that every pirated game, fake ISO, or GTA 6 download carries the same payload, that Rockstar was compromised, or that every attacker behind an unofficial download uses a wiper.

It does fit a broader pattern. Kaspersky has documented RenEngine campaigns that used modified launchers built with the legitimate Ren’Py visual-novel engine, along with fake loading screens and staged payloads, to spread stealers through pirated games. Ren’Py itself wasn’t malware. The attackers borrowed its resources and credibility.

“Games are malware” explains nothing. The real problem is letting an unknown publisher run code on a machine that holds browser sessions, cloud-sync folders, personal documents, and sometimes work credentials. A fake game makes a good delivery vehicle because the victim already expects a huge file, odd installers, antivirus warnings, and unreliable launches. The attack hides inside the normal friction of an unofficial download.

Size is not evidence, and a familiar icon is not provenance

The fake ISO also exploits an understandable but unsafe habit: treating download size as proof that something is real. A 100 GB image feels expensive to make and too big for a quick scam. The junk-data padding Huntress found flips that intuition. The size was part of the costume.

The GTA V icon worked the same way, if less elegantly. It borrowed just enough of a familiar brand to look game-related in a crowded folder. Neither signal can authenticate software. A large file can be empty, an icon can be copied, and anyone can pick a filename. What matters is who distributed the executable, and an unofficial ISO can’t tell you that.

So no single checklist item fixes this. Checking the file size wouldn’t have helped, and a correct icon wouldn’t have guaranteed safety. The reliable decision comes earlier: a game the publisher hasn’t released for PC doesn’t become trustworthy because a torrent took a long time to download.