Following the high-profile leak of Grand Theft Auto 6 gameplay by Cyberleek, cybersecurity researchers have issued an urgent warning regarding widespread Twitch and YouTube gaming scams targeting PC and console gamers. Sophisticated fraud syndicates are hijacking verified streaming channels, broadcasting looped prerecorded footage, and distributing malicious trojan downloaders designed to drain Steam inventories and cryptocurrency wallets.
Payload: RedLine & Lumma Infostealer Trojans, Discord token loggers
High-Risk Targets: Steam inventories, CS2 skins, crypto wallets, Discord accounts
Severity Level: CRITICAL / ACTIVE EXPLOIT CAMPAIGN
How the Hijacked Streaming Scam Operates
In our comprehensive analysis of the Twitch and YouTube gaming scam wave, threat actors compromise dormant verified channels using session cookie hijacking. Once control is seized, they rebrand the profile with official Rockstar Games, Valve, or Epic Games graphics, launch high-bitrate live broadcasts using looped developer leak footage, and flood chat with bot comments praising a supposed ‘Official Early Access PC Demo.’
The stream description and pinned live chat messages direct viewers to password-protected archive links hosted on Mega or Google Drive, bypassing automated virus scanners.
Technical Payload: Steam API Key Hijacking & Session Tokens
Once an unsuspecting user unzips and runs the executable file, the stealth payload initiates without displaying any error dialogs:
| Malware Component | Target Data | Extraction Mechanism | Impact on Victim |
|---|---|---|---|
| Browser Cookie Stealer | Google / Steam / Discord Cookies | Dumps SQLite database encryption keys | Bypasses 2-Factor Authentication (2FA) |
| Steam API Key Logger | Web API Key & Trade Tokens | Registers rogue API key via browser session | Enables trade-intercept man-in-the-middle scams |
| Discord Token Grabber | Discord client local storage | Extracts active bot/user tokens | Spreads scam invitations to all friends & servers |
| Crypto Clipper | Windows Clipboard memory | Swaps copied crypto addresses with hacker wallet | Direct financial theft during transactions |
Top 4 Scam Trends Circulating This Weekend
Gamers should stay alert to four primary fraudulent campaigns circulating across social feeds:
- ‘GTA 6 Playable PC Dev Build’: Falsely claiming to be the full 367 MB Cyberleek dev kit executable.
- ‘CS2 Free Knife / Skin Giveaway’: Phishing portals mimicking Steam Community login pages to harvest account credentials.
- ‘Discord Nitro 3-Month Free Trial’: Malicious bot messages prompting users to authorize rogue third-party OAuth applications.
- ‘Valorant Private Radiant Aimbot / Wallhack’: Executables packaged with silent remote access trojans (RATs).
5 Essential Security Steps to Protect Your Gaming Accounts
Implement these proactive defenses immediately to lock down your gaming ecosystem:
- Revoke Steam Web API Keys: Visit
steamcommunity.com/dev/apikey. If an API key is registered and you didn’t create it, revoke it immediately. - Deauthorize All Devices: In your Steam and Google account security settings, select ‘Deauthorize all other computers’ to kill stolen session tokens.
- Use Hardware or App-Based 2FA: Never rely exclusively on SMS two-factor authentication; utilize Steam Guard or Google Authenticator.
- Never Run Password-Protected Zips: Authentic game publishers never distribute legitimate beta clients via password-protected ZIP or RAR archives.
- Scan with Malwarebytes: Perform an offline system scan using reputable antimalware solutions if an unknown file was executed.
Can hackers bypass Steam Guard Mobile Authenticator?
Yes. If an infostealer steals your active browser session cookie, attackers can bypass login credentials and 2FA prompts entirely without needing your physical phone.
How do I check if my Steam account has an unauthorized API key?
Log into your Steam account and navigate to steamcommunity.com/dev/apikey. If an API domain is registered that you do not recognize, click ‘Revoke My Steam Web API Key’.
Is there any legitimate way to play GTA 6 early on PC?
No. Rockstar Games has confirmed that Grand Theft Auto VI is launching exclusively on PlayStation 5 and Xbox Series X|S in November 2026. Any PC download is 100% fake.