A trailer date is a campaign schedule: fake GTA 6 sites are selling stolen session cookies

A session cookie is a bearer token. Whoever holds it is already inside the fence a second factor guards, which is why Malwarebytes' observation that stolen browser sessions can sometimes be reused without the normal login process is the load-bearing line in its writeup ^[5]. The collection list in this sample puts session cookies alongside saved passwords, browsing history, autofill data and credentials held by FTP clients ^[8]. For anyone doing cleanup, a password reset covers exactly one item on that list. The cookie outlives it unless something server-side tears the session down.

The costume is consumer. Malwarebytes frames the payoff as access to email, social media, gaming and shopping accounts ^[17], and the bait is a demo that does not exist ^[10]. The stealer, though, reads whatever the browser has remembered, across 19 browser targets including Chrome, Edge, Firefox, Brave, Opera and Vivaldi, and it looks at Thunderbird profile directories too ^[7]. Nothing in that sweep distinguishes a personal webmail session from a work single-sign-on session that happens to live in the same profile. An employer betting this one lands only on gamers is betting on staff maintaining clean separation between browser profiles at home.

The part worth reading as a template is the calendar. The first gta6_installer.exe sample was spotted on August 19, one day after the Cyberleek footage and the apparent Leonida map began circulating ^[12], and Rockstar's Extended Look premieres on Netflix on August 27 before reaching its YouTube channel later the same day ^[1]. That is an eight-day window of search volume the operators knew about in advance ^[18], with the November 19, 2026 console release sitting roughly three months beyond it ^[19]. Publishers announce media dates early. So the spike is schedulable, and so is the infrastructure built to meet it.

The triage tell here is cheap and worth keeping. The delivered executable is 1.1 MB, and Malwarebytes notes its own screenshot of one of these sites was larger than the file the site was offering ^[9]. Rockstar has announced no demo and no PC version, and the game is a PS5 and Xbox Series X|S title ^[10], so any Windows executable presented as GTA 6 fails on its face.

Around it sits an audience already being monetised several ways: leaked clips carrying promotion for a cryptocurrency token associated with Cyberleek, a Cyberleek site soliciting donations and selling advertising placement in future GTA 6 videos, and recycled or AI-generated footage passed off as new leaks ^[14]. Take-Two's DMCA subpoenas seek records from Microsoft and Discord to identify whoever is behind the leaks ^[13], which is a different target from whoever is running the stealer network riding the same search terms. Malwarebytes says it detects the sample and blocks the associated sites and infrastructure ^[20], which is one vendor's coverage of the subset it has found. The demand is durable: earlier this year, scammers were charging hundreds of dollars for fake GTA 6 early access ^[15], and in 2022 Rockstar confirmed an attacker had stolen and published development footage ^[16].