Security1 publisher2 min readPublished
Fake GTA 6 installer destroys files behind a staged "License not found" error
Huntress took apart an ISO sold as a leaked pre-release copy and found two RATs, a Discord-webhook infostealer and a Chaos build that overwrites anything above 200MB. All of it is old enough for Defender to catch.
The Watch · Security desk
What happened
- Huntress analysed an ISO advertised as a leaked pre-release copy of GTA 6, whose main file gta6installer.exe still carries the icon from GTA 5.
- Huntress described an opportunistic package: a fake installer, several RATs, an infostealer, ransomware used as a wiper, and a copy of Yandex Browser it could not explain.
- Huntress said nothing in the ISO is new, the malware is several years old, and an up-to-date Windows Defender should detect and block it.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Anyone who ran this handed over a live shell plus saved browser passwords and cookies, which outlasts the destroyed files and reaches whatever else that machine logs into.
- cost Recovery is priced entirely as a restore from storage held off the machine, since no key is being sold and local shadow copies are gone.
- constraint Detection is not the weak link, which confines the residual risk to endpoints running without current Defender signatures rather than to the corporate fleet.
- precedent Reassembling this bundle takes a free GitHub grabber and years-old binaries, so the same ISO shape can be re-cut cheaply for any title with a firm release date.
The 200MB threshold is where the damage decision gets made. The Chaos variant encrypts files 200MB and smaller and overwrites anything larger with random data [14]. Every file on disk falls into one of those two paths [20]. There is no payment channel: Huntress quotes a note telling the victim their files are encrypted forever because the operator has no PayPal or bank account [15], and Huntress reads the family as ransomware repurposed as a wiper [13]. Shadow copies are deleted and Windows recovery is disabled [14], so a restore has to come from a copy held off the machine.
Everything upstream of that is commodity. Multiple NJRAT copies give a shell, keystroke logging, camera access, browser credential theft, live desktop viewing and cryptocurrency wallet details [10]. DCRAT adds clipboard and registry access and rewrites the Windows hosts file so antivirus telemetry never reaches vendors [11]. Mercurial Grabber, a GitHub project labelled for educational purposes only, takes Discord tokens, Chrome passwords and cookies, Roblox and Minecraft session data and Windows product keys, then pushes them out through a Discord webhook [12]. Four named families in one ISO [19], with component files dating to 2023 in many cases [8].
That dating is the useful signal. There is no new tooling here and no operator development to track; the effort went into the packaging. The installer keeps the GTA 5 icon [4], the dropped files in %TEMP% are GTA6-branded [8], and a batch file opens Microsoft Edge to a clck.ru shortlink to confirm the machine has internet before unpacking [9]. The staged error is the whole trick: the victim is warned up front that installation may fail with "License not found" [5], then a script produces exactly that message while the payload installs [6].
What the report does not contain: infection counts, named victims, or where the ISO was seeded [21]. Nothing in it shows a corporate or managed endpoint hit. The plausible enterprise exposure is the ordinary one, browser credential and cookie theft on a personal machine that also touches work [10][12].
The install note is in Russian, and the bundle drops Yandex Browser for a purpose Huntress could not pin down; the firm suggests Russian-speaking users are among the intended targets [16]. The support address printed in the installer had not answered Huntress at the time of writing [7]. Huntress also says an up-to-date Windows Defender should detect and stop the whole bundle [17]. Rebuilding it costs a free GitHub grabber and binaries from 2023 [12][8], and the release date is three months out [1].
What to watch
- Whether the same ISO is re-cut with fresher payloads as the launch date approaches, rather than the 2023-dated binaries Huntress found.
- Whether anyone answers the Russian-language support address printed in the installer, which would attach a handle to the packager.
- Whether the wiper-as-ransomware pattern shows up in bundles built around other unreleased titles with fixed release dates.