Overview
- Security firm Huntress disclosed a live campaign distributing counterfeit GTA6 ISO files that pose as leaked copies but install malware instead.
- The installer shows a Russian-language 'License not found' message as a smoke screen while it drops NJRAT, DCRAT, the Mercurial Grabber infostealer, and a Chaos-family ransomware variant used as a destructive wiper.
- Attackers seed the fakes across search results, forums, torrents and social media and pad ISOs to sizes over 100GB to look like real AAA game images.
- Researchers say the individual malware pieces are largely repurposed and dated, are detectable by up-to-date antivirus such as Windows Defender, and Huntress has published file hashes and IOCs to help defenders.
- Anyone who ran a fake installer should disconnect the device, reset passwords and enable two-factor authentication, and fully reimage compromised systems because the wiper deletes shadow copies and can destroy backups.