Calling this zero-click describes the load, not the loss. The drainer executes as the page renders, before any button press [2]. Nothing leaves a wallet until the visitor connects one and signs a transaction the script hands back [8]. That gap is the whole intervention, because the price tags are fiction: the in-page Solana routine never charges the advertised amount, it reads the balance, reserves enough for the network fee, and queues the remainder to the attacker [7]. On the arithmetic, the $50 card price and the 1 SOL option worth about $102 when Malwarebytes looked [4] put the crypto route at roughly twice the cost of the same nonexistent file [1]. Neither figure is ever taken.
The second payload is the one worth tracking. It runs about 2.4 MB, built around a legitimate and widely deployed library for connecting sites to wallets, which is what lets it speak to many wallets instead of one; bolted onto that is code that inventories the connected wallet, prices its assets, reports the details to the operator, and pulls back transactions for the victim to approve [8]. It is configured for Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base and Fantom, and recognises the major stablecoins on them [9]. That is seven networks against the in-page routine's single chain [3]. Approvals are the part that outlives the visit: depending on what the victim signs, the operator can move tokens and entire NFT collections later rather than immediately [10].
The build quality says something about how the operation is organised. The countdown, the Leonida map and the release grid are accurate and match Rockstar's own announcements of November 19 on PlayStation 5 and Xbox Series X|S with no PC version [3]. The sales copy misspells "download" and refers to GTA IV [16]. The footer states the page offers no purchase, download or payment, sitting directly under two payment buttons, and the facts grid calls the game console-only while the FAQ promises a PC download after purchase [15]. Malwarebytes reads it as a legitimate-looking fan template reused with a pitch pasted on by someone who did not proofread [16]. The drainer is the expensive component. The front end is a template, which is why the lure has changed three times [1] and the objective has not.
There is also a filter in front of the whole thing. The script pulls its settings from the operator's server, and where the relevant option is on, it geolocates the visitor by IP and turns away anyone from a fixed list of ten countries including Russia, Belarus and Kazakhstan, showing a region-unavailable message and a blank page [11] [4]. The setting is named CIS_Protection in the code [12]. Malwarebytes notes that excluding that group is a long-standing convention in criminal tooling, usually read as an attempt to avoid local law enforcement, and declines to draw conclusions about who is running this [13].
