Intro
On August 18, 2026, gameplay footage and map assets from GTA VI began circulating online under the name Cyberleek. The footage was widely assessed as authentic and judging by the urgency of the takedown requests from Rockstar and TakeTwo I tend to believe the assessments.
But Cyberleek isn't the only one cashing in. Within days, fake copies of a "playable Cyberleek build" started showing up on torrent sites and Telegram,and what they actually install has nothing to do with GTA VI.
This piece traces both threads. First, the token economics behind the leak itself, who's profiting and how. Then the malware wave riding this hype. Two separate lure sites, each installing a legitimate but abused ScreenConnect remote access client, tied together by a shared playbook rather than infrastructure. Also found a live Telegram bot, a dead one, and a pivot that opened up a rabbit hole big enough to save for its own write up.
The leak economics
At the time of writing there have been 6 confirmed leaks that Cyberleek is responsible for.
The leak has been released gradually, individual clips are dropped after discord polls (voting with tokens) determine on what gets released next.
That pacing lines up with the campaign’s true reason behind the “manifesto” a Solana token, $CYBERLEEK, launched alongside the leak site. The creator seeded the token’s liquidity pool with 730 million $CYBERLEEK and 330 SOL, locked so it can’t be withdrawn, but structured to earn ongoing trading fees on every buy and sell.
Independent analysis of blockchain activity estimates the creator earned roughly $50,000 in fees on the first day alone, with daily fees continuing to scale with trading volume. A separate allocation of 270 million $CYBERLEEK, worth roughly $390,000 at time of writing, sits in a wallet distinct from the liquidity pool, unlocked and available to be sold off gradually. [1], [2]
Unlike the September 2022 Rockstar breach, attributed to Lapsus$ member Arion Kurtaj (unrelated to this actor), Cyberleek’s identity remains unconfirmed.
This hype cycle is what created the opening for the second part of this story.
Malware Riding the Hype
As you would expect because Cyberleek gained traction, threat actors saw an opportunity around this topic. Within days, they began distributing malware disguised as a playable “Cyberleek build” of GTA VI, via websites [3] torrents, fake ISOs, and Telegram channels.
The packages are of course malicious, delivering a mix of infostealers targeting gaming and platform credentials, and remote access trojans. I grabbed a few samples from the websites cyberleek[.]click & cyberleek[.]info, ran them on a sandbox and confirmed this pattern.
What actually happens when you download it
Profiling
The landing page starts profiling visitors before they even click download. api.ipify.org grabs the public IP, and ipapi.co enriches it with geolocation city, region, country. Combined with user agent, language, screen resolution, referrer, and timestamp, the site builds a visitor profile on page load.
Cloudflare Turnstile & Godaddy builder platform
That's followed by a Cloudflare Turnstile check, likely there to keep automated scrapers, sandboxes, and crawlers out.
Both sites turned out to be built on GoDaddy's Website Builder platform confirmed by backend calls to csp.secureserver.net and img1.wsimg.com. That fits the operational pattern: rapid domain rotation without much administrative overhead.
Telegram
Once profiling and the Turnstile check clear, the page reports back to the operators via api.telegram.org, resolving to Telegram infrastructure in the Netherlands. Rather than running their own backend, the operators use a Telegram bot as a serverless drop point, every event (new visitor, download click, etc.) gets pushed straight into a Telegram chat via the Bot API, packaging up the victim's IP, geolocation, user-agent, referrer, and timestamp.
I tried querying the bot with its token to get a sense of infection volume, but requests return a 401, the token's likely been rotated since. The site also offers a $100 "premium access" payment option.
So I tried to follow the money there too, but the crypto addresses used in the campaign show no transactions.
Execution itself leads to a ScreenConnect (ConnectWise) remote access client being silently installed, configured to establish an unattended guest session to an attacker controlled relay at gg.noktaarts[.]com. Because ScreenConnect is a signed, legitimate tool, it’s a common choice for establishing persistence while evading detection.
On both executions, requests also reached out to cyberleek[.]info, this looks like a two tier operation, with one layer for landing and one for actual distribution.
The ScreenConnect method
After executing the fake MSI, the malware connects to what's most likely the threat actor's own ScreenConnect server. This generates a unique GUID string and it was identical across both malware executions: e934a059a3e150c6, visible in the install path C:\Program Files (x86)\ScreenConnect Client (e934a059a3e150c6)\, created by msiexec.
This turns out to be the ScreenConnect instance ID. Every ScreenConnect relay server (self hosted or via a reseller) generates a unique identifier like this per instance, baked into the installer filename and folder path when the client is built for that relay. That means it's tied to the attacker's specific ScreenConnect tenant, and can be used for detection and pivoting if you have that kind of visibility.
Site Fingerprinting
Looking at the indicators tied to cyberleek[.]click, two separate threads were worth chasing.
VirusTotal's relations data on the dropped file itself, CyberLeekLuncherOpen.zip, confirms this directly, it shows the sample contacting gg.noktaarts.com and resolving to 176.97.210.86, hosted on AS49581 in Germany.
That closes the loop on the cyberleek[.]click sample, the relay seen in the sandbox run is the same one the file reaches out to independently.
From there I pivoted through urlscan.io on cyberleek[.]click's own page components, the CDN calls, fonts, and scripts the site loads. Most of what turned up was generic infrastructure noise, Cloudflare, Akamai, Google. But one entry stood out: www.docsn.cc, already tagged 0xscam on urlscan and hosted in the Netherlands.
Detonating a sample from docsn[.]cc confirmed it's running the same playbook, but on entirely separate infrastructure. The lure here is a fake DocuSign signing request rather than a game leak, and the mechanics are otherwise identical.
A dropped MSI silently installs a ScreenConnect client, this time with instance ID 3bd96abf95efe08e configured to relay through instance-wq4wbt-relay.screenconnect.com and a second hostname, carperterloure.screenconnect.com. Both are distinct from the gg.noktaarts[.]com relay used by cyberleek[.]click, and neither shares hosting with it.
The same visitor profiling pattern from cyberleek[.]click shows up here too, api.ipify.org for the public IP, followed by a callback to api.telegram.org, this time using a different bot token
(8603083225:AAHk80BeTxlUhuK...JVmj2yd4A0). Different token, same mechanism: a Telegram bot as a serverless drop point for victim data, rather than a shared bot instance across campaigns. A couple of other domains round out the lure’s asset hosting.
companieslogo.com and i.ibb.co, both used to pull in logos and images that make the fake DocuSign page look legitimate, standard dressing for this kind of phishing page.
The connection between the two isn’t shared infrastructure, it’s a shared TTP. Two different lure themes, two different ScreenConnect instance IDs, two different relay hostnames, two different Telegram bot tokens, discovered via two different pivots (VT file relations vs. urlscan component analysis) but the same TTP. Profile the visitor via ipify, report back through a Telegram bot, then drop a ScreenConnect client configured to phone home to an attacker controlled relay. That consistency makes me think this is actor’s playbook rather than a coincidence.
Following the second Telegram bot
The first bot token, tied to cyberleek[.]click, was already dead by the time I tried it, a plain 401 Unauthorized, consistent with a token that had been deleted or rotated well before I got to it.
The docsn[.]cc bot however got me different results. A getMe call against it returned a live response
The bot was active, with the username DoNotTryZolBot. Searching for that name and handle turned up nothing, no prior reports, no bot list mentions which fits a campaign this fresh, but it's worth rechecking periodically in case it surfaces elsewhere later.
Shortly after, the same call started returning a different error:
{"ok":false,"error_code":400,"description":"Logged out"}That’s interesting compared to the first 401 error. A 401 means the token itself is invalid, deleted, regenerated, whatever. “Logged out” means the token was valid and the bot’s session was explicitly terminated, either by the operator manually logging it out via BotFather, or by Telegram’s own abuse detection force logging the account out. Given the timing, live, then dead, within a short window of my own probing it’s possible that querying the bot is what triggered the shutdown, probably the operator noticing me poking around.
One for the road
While mapping docsn[.]cc resources, one file stood out in the list, a docuSign.png image, referenced by hash. Pivoting on that hash via urlscan.io returned close to 200 related results.
Most of that turned out to be noise. Checking the hash on VirusTotal showed a generic DocuSign logo image.
That explains the size and the mess of the result set. The set included legitimate businesses whose pages happened to reference the same asset, a cluster of Russian hosted portmap.io credential phishing pages, a separate BunnyCDN based fake document storage kit, and a run of brand squat domains impersonating fintech companies none connected to docsn[.]cc beyond the coincidence of a shared logo.
Two things in that noise were still worth pulling out on their own merits, independent of the logo pivot.
The first is a genuinely tight cluster, several sites dropping ScreenConnect.ClientSetup.exe directly, fronted by Cloudflare Worker subdomains following a consistent naming pattern (installerupdates.workers.dev, newupdatesinstall.workers.dev), reached through redirects from what look like hijacked .com.au WordPress sites. Same payload filename, same Worker naming convention, same delivery pattern making it a real lead rather than the logo hash.
The second is a single standout page: mmgadgets[.]com/mlcrosoftdocxport/, a typosquatted URL (”mlcrosoft” instead of “microsoft”) serving a fake “DocuSign for Microsoft” page that asks the visitor to “verify your identity” and shows a “Generating code...” button consistent with device code phishing.
That’s a completely different technique from anything in the Cyberleek chain but it’s a notable find in its own right.
Both of these are distinct enough in scope and technique that I don’t think they belong together in this research piece
What I wanted to show here is a GTA VI leak creating cover for a ScreenConnect delivery operation across at least two lure themes. The Worker subdomain ScreenConnect cluster and the device code phishing page are worth their own investigation, written up separately so I will probably come back with a part two.
None of the individual pieces here are new, ScreenConnect abuse, ipify fingerprinting, Telegram as a C2 drop point are all well worn techniques. What's interesting is how fast they got repackaged around the GTA hype, and how far a couple of pivots go once you stop assuming the first lure site is the only one.
As always, I hope you are all doing well.
Thanks, take care!
IOC
Confirmed malicious indicators
cyberleek[.]click
cyberleek[.]info
docsn[.]cc / www.docsn[.]cc
gg.noktaarts[.]com
instance-wq4wbt-relay.screenconnect[.]com
carperterloure.screenconnect[.]com
176.97.210.86
91.230.49.19
9264837d2826e63b1683d1077705b4b71b27c40385655008dce44ab2ff5c4d18
46457d98fb1c53bbccb66c1015eb831355f30c8bf8e6f25cf3183aac2a5fd8ab
f87662d5a9fd65adfa3333b416d4b183fcdf3bdccd22fde3dfb65522b69d51c6
d0f4c31f6db7dad5bb305108ebce66e785518a81dc1741ad04951ed0ccd905f5Additional Findings
Those are not malicious on their own but can be used for detection
img1.wsimg[.]com GoDaddy Website Builder backend
csp.secureserver[.]net GoDaddy Website Builder backend
api.ipify[.]org Visitor IP lookup
ipapi[.]co Visitor geolocation enrichment
companieslogo[.]com Asset hosting
i.ibb[.]co Asset hosting
files.manuscdn[.]com Asset hosting
ScreenConnect Instance IDs
e934a059a3e150c6 cyberleek[.]click gg.noktaarts[.]com
3bd96abf95efe08e docsn[.]cc instance-wq4wbt-relay.screenconnect[.]com, carperterloure.screenconnect[.]com
Cryptocurrency Addresses (cyberleek[.]click "premium access" scam)
USDT (TRC20) TFeeqU9iFNSzrnTvfLnbK2nq89CFZHmusg
BTC bc1pd6uh9hudp3ytedku57yx6anqf9mr279xs5qkl0s0up27v00jcf0ss7ct0c
ETH 0x851101B0A6b7917e1e0e0995439E6Fdf4178c788