Fake 113 GB GTA VI leak disables Windows Defender: how cybercriminals exploit the hype

On 22 August 2026, researcher @Aidas29506493 analyzed a 113 GB file circulated on X as a playable build of Grand Theft Auto VI. The result is a warning for anyone looking for shortcuts: almost the entire file is empty, and what little it contains is malware.

A 113 GB lure born from the leak wave

The real leaks published by the leaker known as CyberLeek, who shares gameplay clips and maps in protest against Rockstar's digital pre-order plans, have ignited the hunt for GTA VI early access. On X, someone asked followers to “sacrifice themselves” by testing a 113 GB archive presented as a playable build. The file was analyzed on 22 August by @Aidas29506493, who described it as completely fake and full of viruses.

The choice of a huge file is not accidental: it makes the lure credible. An unreleased AAA game with heavy maps and assets can plausibly exceed a hundred gigabytes. Here, however, the size is a deception.

Inside the archive: 50 KB of malicious code and 99.99% zeros

The researcher explained that the file does not contain 100 GB of real code. The malicious payload is about 50 KB, filled 99.99% with zeros: empty data, no game content. The goal is to bypass automated checks and deter superficial analysis.

The decompiled bytecode reveals what that small payload actually does. First, it runs a PowerShell command that excludes the entire C:\ drive from Windows Defender scanning: Add-MpPreference -ExclusionPath %SystemDrive%\. Then it uses taskkill -f to terminate active security software.

This is not an accidental side effect. It is a preparatory step: by disabling the antivirus, the malware creates the conditions to load subsequent stages without being blocked.

Infection chain: disarm first, then strike

The sequence is simple but effective. The user runs the file believing they are starting an installation or a game. Instead, the malicious code removes the system's defenses. From that moment, any other malicious component can be downloaded and executed without obstacles.

The identified commands are specific and targeted. Add-MpPreference -ExclusionPath %SystemDrive%\ tells Defender to ignore the entire system drive. taskkill -f closes protection processes. Anyone who runs the file ends up with an exposed machine.

According to Tom's Hardware, this is not an isolated case. During the leak wave, fake GTA 6 downloads flooded torrent and piracy sites. IGN confirmed that the mix of authentic CyberLeek material and fake files makes it difficult to distinguish what is safe.

Beyond the giant file: fake sites, mobile apps and phishing

The 113 GB file is not the only trap. Researchers have observed fake GTA 6 websites offering Windows installers based on DLL side-loading, a technique that exploits legitimate programs to load malicious code. There is also a fake “GTA 6 Mobile” app that redirects to a domain linked to info stealers and ransomware.

There are also counterfeit login pages for Rockstar Social Club, created to steal user credentials. Anyone looking for an early build risks handing over accounts, personal data and control of their device.

Kaspersky has documented the scale of the phenomenon: over 19 million malware download attempts disguised as popular game titles in a single year. GTA, Minecraft and Call of Duty are the most abused brands. The mechanism is proven: exploiting the wait for a highly desired game to spread infected files.

What to do to avoid falling into the trap

There is no legitimate playable build of GTA VI in circulation. The launch is scheduled for 19 November on consoles, with a PC version later. Any file promising a playable version before that date is almost certainly a lure.

The recommendations are concrete. Do not download unofficial builds from torrents or piracy sites: if a file seems too good to be true, close the tab. Keep Windows Defender and other security tools active, and never run commands that modify their exclusions or terminate them. Beware of unofficial mobile apps, suspicious login pages and Windows installers from unverified sources.

A file of hundreds of gigabytes for an AAA game not released months earlier is almost certainly a deception, not a leak. The next time someone asks you to “sacrifice yourself” to test it, the safest answer is not to.