Loading story…
A leaker calling itself Cyberleek allegedly published two Grand Theft Auto VI gameplay clips and an image said to show the full Leonida map, framing the release as a protest against Rockstar’s reported digital-only preorder plans and broader monetization practices. The manifesto attributed to the leaker criticized digital preorders, paid single-player unlocks or DLC, and server-dependent ownership models, and threatened additional disclosures unless its demands are met.
The leaked material reportedly shows unconfirmed gameplay elements including basketball, a Focus stat, melee stamina, vehicle storage or openable trunks, fuel and maintenance indicators, a possible six-star wanted level, and an honor-style system similar to Red Dead Redemption 2. Reports also say the map reveals five counties, an extensive rail network, and numerous small islands, while Rockstar Games and Take-Two have moved to remove reposts from platforms including Reddit and YouTube through DMCA takedowns, a response widely viewed as lending credibility to at least some of the leaked files even though the company has not formally authenticated them.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
CyberLeek published another batch of alleged GTA VI leaks while promoting a cryptocurrency token called $CYBERLEEK, saying the funds would support infrastructure, security, and a future strike. The actor also threatened attacks on game companies over digital distribution practices and warned of additional leaks if Rockstar did not meet unspecified demands.
On August 20, 2026, Take-Two Interactive filed DMCA subpoena petitions in the Southern District of New York targeting Microsoft and Discord to identify the person or persons behind the CyberLeek GTA VI leaks. The filings sought extensive account, device, and connection data tied to named Discord servers and related accounts, marking a legal escalation in the company's response.
On August 18, 2026, a group or hacker using the name Cyberleek allegedly released two Grand Theft Auto VI gameplay clips and an image claimed to show the full Leonida map. The leak was described as a protest against Rockstar's digital preorder and distribution practices.
Rockstar Games issued a public statement acknowledging that unauthorized Grand Theft Auto VI gameplay clips had leaked, saying this was not how it intended fans to experience the game and that spoilers could affect the intended experience. The company said the game was nearly finished and asked fans to wait for official information and release.
Federal judges granted Take-Two's DMCA subpoena requests against Discord, Microsoft, and X to identify CyberLeek and other accounts accused of distributing leaked GTA VI material. Take-Two's separate subpoena petition against Google was still unapproved at the time of reporting.
Cyberleek reportedly published additional GTA VI gameplay clips on their website, including footage of a character spelling out “LEEK” on a wall by shooting it. The footage was described as suggesting hands-on access to a working unreleased build, and the leaker claimed to possess the full build.
After the leak spread, Rockstar Games and Take-Two reportedly started rapidly removing reposted GTA VI videos and images from platforms including Reddit and YouTube through copyright takedowns. Multiple reports said this enforcement increased confidence that at least some of the leaked material was genuine, though Rockstar did not officially authenticate it.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
10 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcecyberscoop.com
Open sourcemalware.news
Open sourcemalwarebytes.com
Open sourcexakep.ru
Open sourcetomshardware.com
Open sourcetomshardware.com
Open sourcethecybersecguru.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A purported GTA VI leaker operating as **CyberLeek** released alleged gameplay, map material, and apparent story spoilers while promoting the Solana token `$CYBERLEEK`. Rockstar Games said the game remains unfinished and urged audiences to await its intended November 19 release; Take-Two is pursuing court orders targeting Microsoft, Discord, and X to identify the leaker and stop further disclosures. The token reportedly fell 40% despite additional claimed leaks. Threat actors exploited interest in the leaks by distributing fake playable GTA VI builds through torrents, Telegram channels, and websites including `cyberleek[.]click` and `cyberleek[.]info`. The installers deployed legitimate ConnectWise ScreenConnect clients configured for unattended access through attacker-controlled relays, while lure sites fingerprinted visitors and sent collected data to operators via Telegram Bot API callbacks. A fake DocuSign site, `docsn[.]cc`, used the same profiling, Telegram reporting, and ScreenConnect delivery pattern, indicating a shared playbook but not confirmed common infrastructure or attribution.
Aug 29, 2026
Threat actors are exploiting demand for an unreleased **Grand Theft Auto VI** download through SEO-poisoned search results, gaming forums, torrent sites, social-media posts, and a fraudulent fan countdown site. One campaign distributes oversized, junk-padded ISO files—some exceeding 100 GB—to make a supposed leak appear legitimate. Their `gta6installer.exe` displays Russian-language licensing messages before reporting a deliberate “license not found” failure, while silently installing NJRAT and DCRAT remote-access trojans, the Mercurial Grabber infostealer, and a Chaos ransomware variant used as a destructive wiper. The ISO campaign appears primarily aimed at Russian-speaking users. A separate fake GTA 6 download site embeds a Solana wallet drainer and remotely configured code capable of profiling and draining assets across seven blockchain networks. Victims face theft when they approve a transaction or token/NFT permission request; the site selectively blocks users in several CIS countries and uses anti-analysis measures. Organizations should warn users against unofficial GTA 6 downloads, isolate and fully reimage systems that executed the fake installer, reset exposed credentials and enable MFA. Wallet users that approved malicious permissions should revoke them and move remaining assets to a new wallet if their funds or recovery phrase may have been exposed.
Sep 14, 2026
Cybercriminals set up fake **Rockstar Games** websites advertising a nonexistent **GTA 6 demo** and “Extended Look” content, then pushed a malicious Windows file named `gta6_installer.exe` to users searching for leaked footage, maps, or unofficial builds. Researchers identified the payload as **Vidar** infostealer, a malware family that harvests saved passwords, session cookies, browser history, autofill data, and credentials from other applications, creating a high risk of account takeover through stolen authenticated sessions. The campaign exploited renewed public interest in leaked Grand Theft Auto VI material and used cloned branding tied to Rockstar’s legitimate promotion while inserting deceptive download and “Play Now” buttons. Reporting indicates the sample targeted **19 browsers** and additional software including **Thunderbird**, some FTP clients, and browser components used by other applications, while also relying on dead-drop resolver profiles on **Telegram**, **Pinterest**, and **Steam Community** to locate attacker infrastructure. Published indicators include malicious domains, associated Vidar infrastructure, and a **SHA-256** hash for the sample, and defenders advised affected users to scan infected systems, change passwords from a clean device, revoke active sessions, and remove unknown devices or app authorizations.
Aug 27, 2026