GTA6 Fake ISO Malware Campaign: NURAT & Mercurial Grabber Infection

Vulnerability Overview Type: Malware Name: Grand Theft Auto VI Hype Leads to Malware Release Date: September 9, 2026 Authors: Matt Poto, Ben Hornsby Core Mechanism: Threat actors leverage the high demand among players searching for leaked versions of GTA6, using forged ISO image files (disguised as a GTA6 leak) for propagation. This ISO contains a disguised installer ( ) that, when executed, plants multiple malicious components on the system. Scope of Impact Target Users: Players searching for GTA6 leaked versions Propagation Methods: - Forged ISO files ranking high in search engines - Dissemination via social media, forums, Reddit, and other channels - Files disguised as 10GB AAA-game-sized, but actually filled with junk data Planted Malicious Components: - NURAT: A feature-rich Remote Access Trojan (RAT) with the following capabilities: - Open shell - Keylogging - Access connected cameras - Steal credentials from browsers - Upload and download files - Modify files, registry entries, and processes - View desktop and capture screenshots - Steal cryptocurrency details - DCRAT: Another RAT instance with the following capabilities: - Capture screen screenshots - Keyboard control - Mouse control - Audio device discovery - Window tracking - Clipboard access - Read/write access to the registry - Mercurial Grabber: An information gatherer that collects the following data: - Roblox Studio data - Minecraft session data - Discord tokens - Google Chrome passwords and cookies - System information, IP address, and geolocation - Windows product keys - Screen screenshots Communication Addresses: - NURAT connects to AWS-hosted infrastructure: - - - - Also connects to tunnel services provided by ngrok: - Mercurial Grabber sends data via Discord Webhook to: - Remediation Preventive Measures: - Do not download the GTA6 leaked version from unofficial channels - Verify the source and integrity of ISO files - Scan downloaded files with antivirus software - Run suspicious installers in a sandbox environment Detection Indicators: - Check for the presence of the following files on the system: - - - - - - - - - - - - Check the registry for entries added under the folder - Monitor network traffic for communications connecting to the above IP addresses or domains

Goal Reached Thanks to every supporter — we hit 100%!

GTA6 Fake ISO Malware Campaign: NURAT & Mercurial Grabber Infection