As reported by SecurityAffairs, threat actors are exploiting the frenzy around leaked Grand Theft Auto VI content by distributing a fraudulent 113GB "playable build" that is almost entirely empty padding wrapped around a tiny malicious core. The campaign is a textbook example of event-driven social engineering—opportunistic, scalable, and devastatingly effective against an eager audience.

Threat Alert: As reported by SecurityAffairs, threat actors are exploiting the frenzy around leaked Grand Theft Auto VI content by distributing a fraudulent 113GB "playable build" that is almost entirely empty padding wrapped around a tiny malicious core.

Why This Campaign Works

The attackers are not innovating on the technical side; they are innovating on the lure side. The payload itself is unsophisticated—a roughly 50KB virus buried in 99.99% zero-byte filler. What makes this campaign dangerous is the psychological wrapper: genuine leaked footage from a figure using the handle "CyberLeek" has saturated gaming communities, creating an environment where users are primed to trust anything that appears adjacent to that content. When real and fake material coexist across Discord channels, torrent sites, and mirror pages, verification becomes nearly impossible for the average user.

The most alarming detail is not the malware's sophistication but its first-stage actions: powershell Add-MpPreference -ExclusionPath %SystemDrive%\ followed by taskkill -f against security processes. This effectively neuters host defenses before any secondary payload executes.

Technical Breakdown

Why This Campaign Works
Delivery vector: Peer-to-peer networks, Discord shares, and fake fan sites posing as legitimate GTA VI download hubs
Obfuscation technique: Massive file padding (113GB total, ~50KB actual payload) to evade size-based heuristics and discourage casual inspection
Defense evasion: PowerShell-based Windows Defender exclusion for the entire system drive, forced termination of security processes
Social engineering layer: Exploiting real leak momentum from the "CyberLeek" campaign, which has been releasing authentic gameplay clips in protest of Rockstar's pre-order strategy

Who Is at Risk

While the primary victims are individual gamers, the downstream risk extends to enterprise environments. A machine compromised at home that later connects to a corporate VPN or brings a personal device into a BYOD environment becomes a potential pivot point. The Defender exclusion command is particularly damaging because it persists—once the entire C: drive is whitelisted, subsequent infections operate with impunity even if the original payload is cleaned.

Organizations with younger workforces or permissive remote work policies should treat this as an active threat vector, not a curiosity. The persistence of the Defender exclusion means a single infection can create a lasting blind spot on the host.

Shield53 Recommendations

For Individuals

  • Never download game builds from unofficial sources. Legitimate unreleased games do not appear on torrent sites or Discord servers.
  • Audit Windows Defender exclusions regularly. Run Get-MpPreference in PowerShell and investigate any unexpected ExclusionPath entries, especially root-drive exclusions.
  • Enable Controlled Folder Access in Windows Security to add ransomware protection independent of signature-based detection.

For Enterprise Defenders

  • Deploy EDR with behavioral detection that flags PowerShell execution of Add-MpPreference and taskkill targeting security processes—these are high-confidence indicators of compromise regardless of the initial lure.
  • Monitor for Defender exclusion modifications via Windows Event Log (Event ID 5007) and alert on any system-drive-level exclusions.
  • Restrict PowerShell execution using Constrained Language Mode or application whitelisting (WDAC) to limit the blast radius of script-based evasion.
  • Block known piracy and torrent domains at the network perimeter and enforce DNS filtering on remote endpoints.
  • Brief employees on event-driven scams. Major game releases, movie leaks, and celebrity incidents are predictable catalysts for malware campaigns—awareness should be timed to these events.

Broader Implications

This campaign illustrates a pattern that will repeat with every major cultural moment: threat actors weaponize genuine excitement to bypass user skepticism. The GTA VI launch will generate months of leaked content, fake builds, phishing sites, and counterfeit pre-order pages. Defenders should expect a sustained wave of gaming-themed social engineering through the official release and beyond—and should build detection and awareness programs that anticipate these predictable attack cycles rather than reacting to them after the fact.