The same week that stolen Grand Theft Auto VI footage trickled onto the internet, cybercriminals also ran a second, unrelated campaign built on the same hype: fake "GTA 6 demo" websites rigged to steal browser credentials and session cookies. Neither campaign needed to break into Rockstar Games' network to succeed at scale. One exploited proximity to the company's most sensitive pre-release data; the other exploited proximity to its audience's anticipation. Together, they're a useful case study in how a single high-anticipation product launch can generate two distinct categories of security incidents at once—and why practitioners outside the gaming industry should pay attention.
A familiar extortion playbook, an unfamiliar payday
Beginning in mid-August, an actor operating under the handle "CyberLeek" began publishing gameplay footage and other material tied to GTA VI, ahead of Rockstar's own planned reveal. Whether the source was a network intrusion or an insider with direct access to a build of the game remains unconfirmed, but the daily drip of leaks—reportedly continuing for more than a week—quickly escalated into one of the year's highest-profile data extortion incidents, according to reporting from CyberScoop.
Take-Two Interactive, Rockstar's parent company, has not commented publicly, but its legal team moved fast: the company petitioned a federal court for subpoenas against Discord, Microsoft, X, and Google, and copyright notices followed. Judges granted the subpoenas against Discord, Microsoft, and X; the request targeting Google remained pending as of this week.
What separates this incident from a standard extortion case is the monetization model. CyberLeek paired the leaks with an anti-corporate manifesto framing the campaign as protest against Rockstar's decision to skip physical media, while simultaneously watermarking footage with cryptocurrency wallet addresses and launching an associated memecoin.
"That is a genuinely new monetization model for stolen pre-release content, and it means the usual playbook of negotiating a ransom payment quietly or paying to make it stop won't work." Katie Moussouris, founder and CEO of Luta Security, made that assessment to CyberScoop, noting that the leaker's cryptocurrency token, watermarked footage, and offer to sell ad space on future leaks all pay out in proportion to audience attention—meaning the manifesto isn't really the message; it's the engagement mechanism keeping people watching.
Cynthia Kaiser, senior vice president at Halcyon's ransomware research center and a former deputy assistant director of the FBI's cyber division, sees the underlying mechanics as familiar even if the packaging is new. Rather than take a stated motive at face value, she separates it from what the behavior actually shows: threat actors who lead with a cause while running a monetization channel are typically telling their audience what will land, not what's actually driving them, she told CyberScoop. Kaiser draws the closer historical parallel not to the 2014 Sony Pictures breach, but to Iranian state-linked actors' theft of HBO's "Game of Thrones" episodes—a hacking-for-hire scheme that also hit dozens of universities and other companies for stolen intellectual property rather than destructive intent.
The subpoena's own blast radius
Take-Two's broadest subpoena, directed at Discord, doesn't just target CyberLeek. It seeks identifying data—including device identifiers, login records, and cloud storage contents—for every account that posted in three Discord servers where the leaked material circulated, going back to June. Moussouris flagged that scope as a concern that extends well beyond this one case, arguing that the people best positioned to identify how the leak actually happened are investigators doing forensic legwork, not a subpoena broad enough to sweep in anyone who happened to be on the same server.
For security and legal teams, that's a reminder that a company's own incident response—not just the initial breach—can create its own bystander data-exposure problem, particularly when discovery requests are drafted broadly to compensate for an unclear attribution picture.
The same week, a different kind of theft
Malwarebytes' own coverage connects the two storylines directly. Researchers there first observed a fake GTA 6 installer, gta6_installer.exe, on August 19—one day after leaked material began circulating—and separately warned that Take-Two's Discord subpoena hunt for CyberLeek could itself expose data belonging to thousands of uninvolved Discord users, echoing Moussouris's concern. Same platform, same week, two distinct ways bystanders' data ends up at risk: one from opportunistic malware riding the leak's coattails, the other as legal fallout from the response to it.
The malware campaign itself, detailed in Malwarebytes' research and first reported more broadly by TechCrunch, is straightforward hype-jacking. Cybercriminals stood up a network of sites impersonating Rockstar that surfaced in searches for a GTA 6 demo—no such demo exists—and mimicked the studio's genuine promotional material for its Netflix "Extended Look," which aired on August 27. A "Play Now" button delivers not a game installer but a payload from the Vidar family, an established infostealer sold as a service to other criminals, according to Malwarebytes.
Malwarebytes' analysis found the sample checks for saved data across 19 browsers, including Chrome, Edge, Firefox, Brave, Opera, and Vivaldi, and also searches Thunderbird profile directories. Notably, it also targets Perplexity's Comet browser and the WebView2 component embedded in Roblox Studio—a sign that the malware's authors are chasing newer, less-obvious surfaces alongside the usual browser targets. Researchers observed no persistence mechanism: no registry startup entries, scheduled tasks, or services. That's a lower-effort build, not a lower-impact one, since an infostealer only needs to run once to exfiltrate saved logins and—more consequentially—active session cookies, which in some cases can let an attacker bypass multi-factor authentication entirely by reusing an already authenticated session.
The takeaway for security teams
Neither campaign required a novel technique. What's notable is that they ran in parallel, against the same event, generating risk on both sides of the company's perimeter at once. Organizations preparing for their own high-anticipation moments—a major product launch, an earnings call, an entertainment release—should model insider-extortion and impersonation risk as a single planning exercise rather than two separate playbooks: one owned by legal and IR, the other by brand protection and customer-facing security awareness. And as this incident shows, the response to a leak, not just the leak itself, can widen the pool of people whose data ends up exposed.
