Grand Theft Auto VI hype leads to malware

This report analyzes a malicious campaign distributing fake GTA6 ISO files that install a suite of malware—multiple NJRAT instances, DCRAT, the Mercurial Grabber infostealer, and Chaos ransomware used as a destructive wiper—alongside a bundled Yandex browser and decoy messages to mask infection. The analysis details installation behavior, persistence, network C2s (including AWS-hosted IPs, ngrok, and xsph.ru), hosts file modifications, a Discord webhook used by the infostealer, and IOCs (file hashes, filenames, domains, IPs), and provides mitigation guidance recommending network isolation, password resets, 2FA, and full reimaging.