WARDEN Stealer: Fake GTA 6 PC installer — steals Steam/Roblox credentials, browser data and crypto wallets
Severity: medium · Patch status: no-fix-needed · Since 2026-11-13
Cynet researchers traced a "GTA 6 EXE download" link from a Google Colab notebook to a "Windows Software Hub" page offering a 72 MB download with fake "Virus Free" and "Verified" badges. The archive contained a 796 KB executable and a README instructing users to run as administrator and add antivirus exclusions. The binary is a WARDEN Stealer loader with no game assets: it detects VMs/sandboxes, injects into browser processes, harvests saved passwords, cookies, Steam and Roblox credentials and crypto wallet data, swaps clipboard cryptocurrency addresses, and can fetch additional malware. Probable C2 is uroker[.]casa. GTA VI launches November 19 with no PC version, so any PC installer is fake. Cynet published SHA-256 hashes for detection.
What to do
- Block C2 domain uroker[.]casa and the file SHA-256 hashes published by Cynet
- Warn users not to run untrusted executables as administrator or add AV exclusions for game downloads
- Monitor for stealer indicators: browser process injection, clipboard modification, unexpected outbound connections
- Enforce application allowlisting and block execution from user-writable directories
- Educate staff/gamers that GTA 6 has no PC version; any installer is malware
Sources
All live incidents on Threat Watch