From GTA VI scams to everyday attacks, buying protection is only the start

A fake GTA VI download and a fraudulent delivery message may seem unrelated, but both exploit the same vulnerability, misplaced trust. One dangles early access to a highly anticipated game, while the other appears just as someone is waiting for a package. Security software helps, but staying safe also means questioning unexpected requests and protecting the accounts tied to them.

More people are buying tools to protect themselves, as our latest marketplace data shows. Orders for antivirus and security software are up 35% from last year, now outpacing VPNs. Overall, cybersecurity product orders rose by 24%, and security software made up a larger share, growing from 39% to 43%.

VPNs remain the largest category, but the shift shows that people are now buying more than just privacy and secure connections. For CISOs, this is a chance to help people understand how different protections work together, like using secure accounts and having good recovery options.

These numbers do not show why each person buys protection or if it actually helps, but they give a starting point. As Cybersecurity Awareness Month ends, Black Friday, Christmas and the GTA VI release create more opportunities for convincing lures, so it is important to stay cyber-aware.

Because these situations carry potentail risks, the conversation should go beyond buying security software to include educating ourselves about what to spot and what to do in these adverse situations. In August 2026, Malwarebytes found fake Rockstar websites offering what looked like a GTA VI demo. These sites copied real promotional material, but the download contained malware that could steal browser passwords and active sessions.

These websites placed fake offers alongside real information that fans recognised. Someone searching for news might see familiar images and accurate details, but still not realise that the offer to play was actually unsafe. This trick is not limited to gaming. Criminals make their requests seem more believable by tying them to real events in a person’s life. For example, someone who just got a new job might expect HR forms, or someone moving might believe a delivery message.

As I recently shared with Stylist, a leading UK lifestyle magazine, single daily posts can reveal more when viewed together. For example, a quiz about your first pet or street could give away answers to security questions, and even deleted posts can still be saved or shared. The NCSC also warns that criminals use public information to make phishing attempts seem real. Their advice highlights how authority, urgency, emotion, scarcity and current events can push people to act before checking.

This is why advice that only looks for spelling mistakes or poor website design misses the bigger issue. Instead of trusting how real a message looks, people should check claims directly using the official website or app. Companies can help by making regular announcements, offering clear ways to report issues, and having support teams ready to confirm real requests. When criminals copy a campaign, security and communications teams should work together so customers know where to turn.

Organisations can also do a deep dive into whether their own processes make impersonation easier. Collecting extra personal information means more data to protect, and using recovery questions based on public facts provides weak proof of identity. Keeping software updated remains a key way to stay protected. Verizon’s 2026 Data Breach Investigations Report found that vulnerability exploitation was the leading initial access vector, accounting for 31% of breaches. Although the report is not solely about consumers, it reinforces that timely software updates are an essential layer alongside strong account security and scrutiny of unusual requests.

The GTA VI investigation also showed that protection is needed even after logging in. Malwarebytes found that stolen session cookies or authentication tokens could sometimes allow attackers to reuse an authenticated session without re-entering the password or completing MFA again. This does not mean that MFA itself has been broken: the attacker is reusing the result of an earlier successful authentication. MFA is still important, but it needs to be backed up by device protection and recovery controls. Changing a password alone may not invalidate every active session, depending on the service.

If an infostealer may have run, disconnect the affected device and stop using it for sensitive sign-ins. From a known-clean device, revoke active sessions and tokens, change critical passwords, and review recovery details, trusted devices, forwarding rules and connected applications. The affected device should then be investigated and securely cleaned or rebuilt. Businesses should make these steps easy and help customers understand that more than one action may be needed.

Customers expect businesses to take the lead on security, but the findings also highlight a need to strengthen awareness of personal responsibility. Our research with Juniper Research, involving 9,000 people across nine countries, found that every country and demographic group ranked the e-commerce website or app as most responsible for security. Overall, 50% placed responsibility with the platform, followed by banks and payment providers at 30%, and users themselves at 20%. Meanwhile, 32% chose their payment method to avoid sharing financial details with merchants. For CISOs, this means combining clear information, control over personal data and reliable support with practical guidance on the steps customers can take themselves. Businesses need to meet those expectations while helping people understand their own role in protecting accounts and recognising suspicious requests.

The issues seen in GTA VI scams also apply to regular shopping accounts or delivery messages. As more businesses invest in security software, they have a good starting point. The next step is to connect that investment with measures that help people check requests and recover if something goes wrong. This way, the increased focus on protection in October can lead to safer habits and better services all year round. 

_______

About Adrian Podkaminer

Adrian Podkaminer is Chief Information Security Officer (CISO) at G2A.COM, the world’s largest marketplace for digital entertainment, trusted by more than 35 million users across 180 countries. He leads the company’s cybersecurity strategy, protecting a global platform that processes thousands of secure digital transactions every day and connects buyers with verified business sellers worldwide. With a background spanning software engineering, cloud security, and cybersecurity leadership, Adrian specializes in securing large-scale digital ecosystems and enabling the safe adoption of emerging technologies. Passionate about innovation, he is an early adopter of AI, cloud computing, and Kubernetes, and actively explores new technologies through his home lab and personal projects in software-defined radio (SDR) and wireless network security.