Fake GTA 6 Extended Look and demo sites deliver an infostealer

This report describes a live malware campaign where attackers hosted convincing fake Rockstar/GTA 6 demo sites that distribute a 1.1 MB Vidar infostealer (gta6_installer.exe). The malware steals saved passwords, session cookies, browsing data, and other credentials by launching legitimate browser binaries against temporary profiles, uses dead-drop resolvers (Telegram, Pinterest, Steam) and multiple command-and-control domains, and includes comprehensive IOCs and remediation steps.