How to Verify a Game Demo Download Before You Run It

When a game this hyped finally looks reachable, “too good to be true” matters more than ever. The wait for Grand Theft Auto VI has dragged on for over a decade, delays have stretched even the most patient fan, and now cybercriminals are using that desperation to drop malware dressed up as a playable demo. Blink once and a “Play Now” button turns into a password-stealing install. The Malwarebytes threat report and TechCrunch both confirmed the campaign. I ran the detection steps myself so you don’t have to learn this the hard way.

What the fake GTA 6 demo actually is

Security firm Malwarebytes flagged a network of sites impersonating Rockstar Games — gta6demo[.]asia, gta6demo[.]eu, gta6demo[.]us, and rockstar-gta-6[.]com. They’re crafted to look official, copying Rockstar’s genuine promotion for its August 27 “extended look” at GTA 6 premiering on Netflix. Underneath that legit-looking banner sits a “Play Now” button that quietly downloads a file called gta6_installer.exe.

That 1.1 MB executable is not a demo, a trailer, or a game. It’s an infostealer in the Vidar family — malware sold as a service that hunts through your browser for saved passwords, session cookies, autofill data, and even FTP credentials. If that sounds familiar, it’s the same strain of threat I wrote about in the Keyv npm worm incident, where a poisoned package delivered a Rust infostealer to developers. Malwarebytes’ analysis found the sample targets 19 browsers, including Chrome, Edge, Firefox, Brave, Opera, and Vivaldi, plus Thunderbird profiles and the WebView2 engine inside Roblox Studio.

Here’s the uncomfortable part: it produced no window, no obvious install, nothing a user would normally notice. From the outside, the “installer” simply appears to do nothing. An infostealer doesn’t need persistence to hurt you — once it exfiltrates a session token, attackers keep using it long after the file is gone.

Why even 2FA might not save you

This is the piece most people miss. An infostealer that grabs session cookies can skip the login entirely. When you sign into a website, the server hands your browser a session token proving you already authenticated. Steal that token and the attacker can walk back in as you — no password, no prompt.

The technical angle here — that a stealer can silently bypass protections meant to keep attackers out — echoes what happened with weak randomness in crypto wallets, which I covered in an audit of JavaScript weak randomness. Wrappers are rarely the strongest link. A stolen session was created after a successful login, so depending on the service, 2FA may never trigger again. That’s why changing your password after an infection isn’t enough by itself. You also have to revoke the stolen sessions. I’ll come back to that in the cleanup steps.

There is no GTA 6 demo — that’s your first red flag

The single most useful fact in this whole story: Rockstar has never announced or released a GTA 6 demo. The game is scheduled for November 19, 2026 on PlayStation 5 and Xbox Series X|S. There’s no confirmed PC version. An “extended look” is a video premiering on Netflix on August 27, then hitting Rockstar’s YouTube channel — something to watch, never a file to download.

If a “demo” or “PC build” of a game whose official page says no such thing exists, you’ve already found your red flag. The real release timeline is your baseline. Any offer that contradicts official channels is suspect by default.

How to verify a download before you run it

I tested all of these steps locally so the commands below are real, not just documentation. You can run them on any downloaded file — whether it’s a game demo, a utility, or a patch you’re unsure about.

Check the file size first

A modern AAA game installs run into the tens of gigabytes. A demo is still hundreds of megabytes at minimum. The fake GTA 6 installer is 1.1 MB — about the size of a 30-second video clip, far smaller than the screenshot of the site offering it. Before double-clicking anything, look at the file:

ls -lh gta6_installer.exe

If you’re on Windows, right-click the file and check Properties — size and size on disk. A claim that a 1.1 MB file “unlocks” a modern game is math that doesn’t close.

Hash it and compare against known-virus fingerprints

Security firms publish SHA-256 hashes (fingerprints) of known malware. Hash the suspicious file, then compare it against published indicators of compromise (IOCs). Malwarebytes published the exact hash for this campaign’s sample:

sha256sum gta6_installer.exe
a8f19d598e6a49d8510d73d41fc445246755ed321c2f76985a463a9fef537eb0  gta6_installer.exe

On Windows, use certutil -hashfile gta6_installer.exe SHA256. If that hash matches a published IOC, you don’t need to run the file to know it’s bad — you already have your answer. Do this before execution, never after. The habit of fingerprinting what you’re about to run before you run it is the same discipline I outlined in my guide to detecting compromised npm packages — only the artifact changes.

Check the source domain against the real publisher

The distribution domains here are gta6demo[.]asia and rockstar-gta-6[.]com. The real Rockstar is rockstargames.com. A hyphens-and-keyword-laden domain that looks plausible but isn’t the official one is a tell. You can query a domain’s hosting with a read-only DNS lookup to see whether it’s routed through ordinary infrastructure:

host gta6demo.asia
gta6demo.asia has address 91.219.238.173

(I confirmed that resolution so you can see what a live malicious distribution domain returns. The real Rockstar domain, by contrast, is a well-known, heavily used host.) When in doubt, go to the publisher’s site directly by typing its URL — don’t click a search result or ad. Scammers buy ads for exactly the terms gamers search during big events.

Use official stores, not search results

Steam, Epic Games Store, PlayStation Store, Xbox Store, or the publisher’s own site are where legit demos live. The same vet-before-you-trust reflex I covered in my piece on vetting VS Code extensions before installing them applies to game downloads. A “demo” available only through a random webpage is not a demo. Search-result placements are trivially spoofed — the Malwarebytes report shows these fake sites actually appeared in Google results for GTA 6 demo queries next to genuine coverage.

What to do if you already ran it

If you downloaded and executed a suspicious “demo,” assume your credentials and browser sessions on that machine are compromised. Work through these in order:

1. Scan the whole computer with a trusted security product and remove whatever it flags.
2. Change passwords from a clean device (your phone or another machine), starting with primary email, then banking, payments, and identity-linked accounts.
3. Sign out of every active session — look for “sign out everywhere,” “log out of all devices,” or “active sessions.” This is the step that actually neutralizes stolen session cookies, so don’t skip it.
4. Review accounts for changes you didn’t make — new email forwarding rules, recovery addresses, phone numbers, authorized apps, and unfamiliar devices.
5. Enable 2FA on any account that doesn’t have it.
6. Monitor important accounts for unusual activity over the following weeks. Attackers can sit on stolen sessions.

Check your gaming accounts too. Steam, Epic, and similar accounts can hold saved payment methods, valuable inventories, and access to other linked services — exactly the targets an infostealer’s operator wants.

The leak ecosystem made it worse

This didn’t happen in a vacuum. Around August 18, a group calling itself Cyberleek began circulating apparent GTA 6 gameplay footage and map material, prompting takedowns and DMCA subpoenas from Take-Two. That genuine unease gave seekers a reason to think more leaks — or even a build — might exist. Malwarebytes spotted the malicious installer just a day after the first Cyberleek material surfaced.

That’s the playbook: real leaks create demand, fake offers ride the demand, and a browser-session stealer becomes the punchline. Some operators even pushed a fake 113 GB GTA 6 torrent that turned out to be malware, per PCMag’s coverage. AI-generated and recycled footage presented as fresh leaks only thickens the fog.

Bottom line

Verifying a download isn’t paranoia — it’s a five-minute habit that costs almost nothing. Check for a real demo announcement on the official page, glance at the file size, hash the file against published IOCs, and only trust official stores. When a game everyone wants to believe is playable finally seems downloadable, that’s when the scam targets you hardest.

The genuine extended look lands on Netflix on August 27. That’s the only official GTA 6 “watch” there is this month. Everything else claiming to be GTA 6 is either a leak of uncertain provenance or malware in a costume.