Following a week of leaks attributed to a source known as Cyberleek, a file claiming to be a leaked playable build of Grand Theft Auto VI began circulating online. X user @GTAGolden_ shared word of a 113GB ISO file, reportedly spreading on torrent sites, and asked followers to verify whether it was a legitimate build of the game.

An online sleuth using the handle @Aidas29506493 decompiled and reverse engineered the file and found it was fake and loaded with viruses. According to their analysis, the massive file size was mostly padding—described as 99.99% empty junk made up of endless zeroes—wrapped around a 50KB virus.

The decompiled bytecode reportedly contained commands to disable security protections, including a PowerShell command that whitelists the entire C:\ drive in Windows Defender (Add-MpPreference -ExclusionPath %SystemDrive%\) and a command to kill security software (taskkill -f). It remains unclear exactly what the malware does once these protections are bypassed, but with Windows Defender disabled and no other antivirus running, the malware could operate largely unimpeded.

Other users corroborated the findings by examining the game files without installing or running them. They noted that the installer was reportedly kept to around 1GB in order to slip past VirusTotal detection, and that the fake build used .doi files—associated with DODI Repacks, a different game's release format—to help disguise the virus. Some files from a 2023 GTA VI leak were also reportedly included among the fake build's contents.

The fake build appeared amid a wave of real leaks from Cyberleek, who has been releasing GTA VI gameplay clips and details of the game's map, reportedly in protest of Rockstar's decision to offer pre-selling digital copies, which Cyberleek called anti-gamer. Take-Two Interactive has reportedly sought device IDs from members of three Discord servers in an effort to identify the leaker, though it may take time to do so given the leaks have continued daily.

With anticipation for GTA VI running high—Rockstar is set to release an extended look via Netflix on August 27—bad actors appear to be exploiting the hype by distributing fake ISOs to spread malware. Sources note that pirating unreleased software carries heightened risk, and recommend waiting for the game's official November release rather than downloading unverified files.