CyberLeek threatens to leak a playable GTA 6 build if its Solana meme coin hits a $30 million market cap, but the build remains unverified. CyberLeek, the anonymous figure behind this summer’s wave of GTA 6 leaks, just raised the stakes considerably. After dropping 25 minutes of gameplay footage earlier last week, including nudity and dev menu access, they’re now threatening to release a complete, playable build of the game, start to finish. “A GTA 6 leaker has reportedly threatened to put out a complete, playable build of the game, start to finish.” reads Eurogamer.net. “The threat was posted on CyberLeek’s website after the leaker shared 25 minutes of footage from the game earlier this week.” CyberLeek posted the threat on its own website. The demand is simple: if its cryptocurrency reaches a $30 million market value, the leaker will release the playable build of GTA 6, including the full story mode, from start to finish, with the ending credits. CyberLeek says Take-Two can avoid the leak only by providing physical copies of the game and issuing a public apology. This sounds more like a challenge than a serious negotiation. “Here’s the deal, nice and clean,” the leaker states. “CyberLeek hits 30 million marketcap, the build goes out — full story mode, played to the end, credits and all. Don’t believe it has full story mode? Ask for what you want to see, and it gets provided. Take-Two gets one way out: physical disks and a public apology. They can take it at any moment. Or they can gamble that CL is bluffing. Everyone knows which one they’ll pick.” This is not CyberLeek’s first leak. Rockstar previously said the situation was painful and that this was not how it wanted fans to see the game after years of waiting. Take-Two, Rockstar’s parent company, has been trying to identify the leaker and even sought a court order requiring Discord to share information about their identity. The company is actively trying to stop the leaks rather than waiting for the situation to pass. Take-Two, Rockstar’s parent company, has been actively hunting for the leaker and tried subpoenaing Discord for identifying information, so this isn’t a studio sitting back and hoping it blows over. The efforts to stop the leaks have not worked so far. CyberLeek went silent for a while, then returned with new footage showing Jason fully naked and Lucia topless. Eurogamer reported that the video appears to be real and carries CyberLeek’s usual watermark. CyberLeek did more than leak game footage. It also launched a Solana meme coin and uses the videos to promote it. Reports said the coin reached a market value of $25 million in late August, with more than $36 million in trading volume in a single day. Its value then fell sharply after Rockstar released official gameplay footage on Netflix and interest in the leaks declined. The new $30 million target is important because reaching it could trigger the release of a playable version of GTA 6 before the official launch. Whether CyberLeek genuinely has a full playable build worth leaking is still unverified. “The knowledge that a playable build of GTA 6 might be online has unsurprisingly encouraged hackers to lure curious users searching for it on unfamiliar websites.” states TechSpot. “Files labeled as the build have recently appeared on torrent websites, but these are certainly malicious. There is no evidence that CyberLeek or anyone else has, or even can, release an early version of the game.” Fake downloads claiming to be the leaked build have already started circulating on torrent and piracy sites, several reportedly carrying malware, so anyone tempted to go looking is more likely to get infected than to get an early copy of GTA 6. Take-Two has already lost close to $2.8 billion in market value over a 48 hour stretch tied to this leak saga, which tells you how seriously the market is taking the threat, even unverified. GTA 6 is still set for a November 19 release on PlayStation 5 and Xbox Series X/S, and neither Rockstar nor Take-Two has commented on this latest ultimatum. Extortion tied to a crypto pump scheme is a genuinely new flavor of leak drama, and it probably won’t be the last time someone tries combining the two. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, GTA 6)
Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the problem. A secure connection didn't always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves.
Canadian cybersecurity executive Edward Dubrovsky has been arrested in Pennsylvania in connection with alleged extortion activity that multiple reports have linked to the FBI's ongoing crackdown on the ShinyHunters hacking group. Dubrovsky, 54, has had senior roles at cybersecurity firms that help data breach and ransomware victims negotiate extortion payments with cybercriminals. Yesterday, FBI Director Kash Patel announced that agents had arrested "another suspected co-conspirator of the ShinyHunters group". The New York Times reported that the suspect was a Canadian citizen arrested in Pennsylvania and believed to be a primary co-conspirator in the recent ShinyHunters FBI Jobs hack. Last night, both Politico and KrebsOnSecurity reported that Dubrovsky was arrested in Pennsylvania, where he was attending a cybersecurity conference.
Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. Details of the flaws are below - CVE-2026-105133 (CVSS v4 score: 5.5) - An improper authentication vulnerability in the checkSysPwd() function in the "com/ahsay/obs/api/ApiStructsAction.java"
As enterprises race to deploy autonomous AI agents to accelerate business, a new report reveals they are tethered to security architectures built for a different era. The "Horizons of Identity Security" report from SailPoint highlights a critical “velocity paradox,” in which organizations invest in AI-speed business operations while continuing to rely on human-speed security controls, creating a
The crooks have trust problems of their own. One ransomware affiliate decided to keep the profits for himself. Elsewhere, an attacker left a server exposed, complete with tools and traces of an intrusion. Apparently, keeping things secure is a problem on both sides of the fence. The rest of the week isn't much more reassuring. Malicious code turned up in developer packages and extensions that
Attackers behind a string of personal data leaks at Japanese organizations have abused APIs for mobile apps and targeted known software flaws, the JPCERT Coordination Center (JPCERT/CC) said. The Tokyo-based center, which takes incident reports, based its October 8, 2026 alert on those reports and other information. The alert names no attacker and no affected organization. JPCERT/
The U.S. Department of Justice (DoJ) on Wednesday announced charges against a 50-year-old U.S. and Israeli national for allegedly defrauding ransomware victims by secretly paying the attackers to obtain decryptors while claiming to use proprietary tools to recover their data. Zohar Pinhasi (aka Zack Silver and Zack Green) has been charged with two counts of wire fraud and one count of wire
Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments The post Evolution of Web3 in Cloud Supply Chain Attacks appeared first on Unit 42.
A suspected ShinyHunters member arrested in Jordan is reportedly cooperating with the FBI, helping investigators track down the group. A suspected member of ShinyHunters, the group that claims to have stolen data on every FBI employee, was picked up in Jordan this week. The man is Saif al-Din Khader, detained by Jordanian authorities, with two sources placing the arrest on Tuesday. Reuters couldn’t confirm the exact circumstances or where he’s being held. “A suspected member of the ShinyHunters hacking group, which says it stole data on every FBI employee, was detained in Jordan this week and is cooperating with the FBI, three people familiar with the matter told Reuters.” the Reuters states. Two sources said he’s now helping the FBI and international law enforcement track down the rest of the group. One source told Reuters that Khader is showing investigators his own devices and digital communications to help identify former associates. That gives investigators real access to potential evidence, not just a general promise to cooperate. “The FBI declined to comment on any specific arrest or activity abroad but said that the bureau “continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects — and we will spare no resource in bringing each of the responsible individuals to justice.”” Reuters continues. The case matters beyond Khader’s arrest. ShinyHunters claims to have stolen personal data on FBI employees, and Reuters’ earlier analysis found that the leaked sample included detailed personal information, sensitive job-related data, and psychiatric and medical records. Some have compared the incident to the 2015 OPM breach, in which a China-linked attack exposed security clearance data belonging to millions of Americans. If the ShinyHunters claims are even partly confirmed, that comparison would be justified. Dutch police confirmed this week that the 24-year-old man from Amsterdam was arrested earlier this month as part of an investigation into the cybercrime group ShinyHunters. The suspect appears before Rotterdam District Court today, September 29. Multiple sources, including KrebsOnSecurity, have identified him as Pepijn van der Stap, a Dutch hacker previously known online as “Umbreon.” The connection to ShinyHunters runs through the “Umbreon” alias. Van der Stap used that handle and Pokémon imagery on BreachForums as early as 2021. Source KrebsOnSecurity Then the FBI jobs site defacement that ShinyHunters left after the FBIjobs.gov breach prominently featured an ASCII art version of the same Pokémon character, and the image appears identical to one used in a 2020 HackForums defacement attributed to ShinyHunters, a year before Van der Stap created his Umbreon account. That last detail cuts both ways: either the alias predates him in this context, or the timing coincidence is genuinely awkward. KrebsOnSecurity adds a more pointed interpretation: sources familiar with the investigation say the Umbreon imagery in the FBI defacement may have been a deliberate attempt by ShinyHunters’ current leader, a teenager from Amman, Jordan known as Rey, to pin the hack on Van der Stap. The two reportedly had ongoing bad blood over control of the ShinyHunters brand and data. FBI Director Kash Patel had already hinted that more arrests were coming. “FBI teams are working new leads RIGHT NOW. More arrests are on the table.” Patel wrote on X. NO SAFE HAVEN. Working with our Dutch National Police partners, the FBI helped put an alleged leader of ShinyHunters—a global cybercrime threat actor—behind bars. And we’re not done. FBI teams are working new leads RIGHT NOW. More arrests are on the table. If you attack… pic.twitter.com/T7CK4KIKl9 — FBI Director Kash Patel (@FBIDirectorKash) September 30, 2026 ShinyHunters’ own infrastructure has been wobbling since this week started. Reuters lost contact with the group’s usual communication account on Tuesday, the same day Khader was reportedly detained, and by Wednesday the group’s dark web leak site had gone offline entirely. The alleged leader of the group, Rey, told journalist Brian Krebs in November 2025 that he’d been quietly cooperating with law enforcement since June, well before any of this became public. In November 2025, security journalist Brian Krebs reported that Rey was Saif Al-Din Khader after analyzing information obtained from infostealer logs and speaking directly with Khader over Signal. What is new is what cooperation can look like when someone is in custody. An FBI Cyber Division official explained the situation last week: arrests can make people more willing to talk, while seized servers can reveal information about those who are still outside. Once someone’s laptop becomes evidence, loyalty can disappear very quickly. A new ShinyHunters leak site reportedly came back online on Thursday, so the group itself isn’t dead, just missing one more member. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ShinyHunters )
Confirm this action.
Leaving now will discard your changes.