Fake GTA 6 Leaked Copy Site Steals Cryptocurrency from Connected Wallets

A fake GTA 6 leaked copy site has been discovered by Malwarebytes, which targets visitors in three different ways. In June, similar sites sold 'early access' to the game for hundreds of dollars in cryptocurrency. These sites delivered an infostealer instead of a playable version.

The latest site looks like a GTA 6 fan countdown but offers to sell a leaked copy of the game. However, it loads a wallet drainer as soon as you arrive, designed to steal cryptocurrency and other assets from connected wallets. The drainer checks the visitor's balance, leaves a small amount for the transaction fee, and prepares to transfer everything else to the attacker.

The site is configured to target wallets across seven blockchain networks: Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base, and Fantom. It recognizes major stablecoins on those networks and can request several kinds of access. Depending on what the victim approves, it could transfer cryptocurrency immediately or gain permission to move tokens and entire NFT collections later.

Before asking the visitor to connect a wallet, the script downloads its settings from the operator's server. If a particular setting is enabled, it uses the visitor's IP address to identify their country and checks it against a fixed list: Armenia, Azerbaijan, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Russia, Tajikistan, Turkmenistan, and Uzbekistan.