Target: GTA 6
Research Source: PreCrime™ Labs

BforeAI’s PreCrime Labs identified a cluster of 16 unauthorized mobile applications on Google Play exploiting public anticipation for Grand Theft Auto VI (GTA 6). Rockstar Games has not released any official companion app, map tool, or mobile version of the game, therefore making every app in this cluster unauthorized. The apps target consumers (including minors, given PEGI 3/”Everyone” ratings) searching for GTA 6 news, maps, or guides ahead of a confirmed public release date, and collectively claim distribution reach of up to 165 countries.

This matters because the apps use brand-identical iconography (the official teaser’s pink/purple “VI” logo, palm-tree key art), and in one case directly impersonate the developer identity (“GTA Mobile Games”), creating real risk of consumer confusion with an official release.

Operationally, this cluster is distinct from one another since they are under unrelated developer names, and one developer (HorizonApps[.]at) operates multiple listings under the same visual template. One listing embeds financial-scam-adjacent search terms (“gta6 forex”, “gta6 trading”), and a second disguises GTA-typo branding inside an unrelated horror-game listing carrying the same terms, likely leveraging the hype and popularity of the game ahead of its release.

This can allegedly be an attempt at app-store-optimization tooling and a monetization objective that extends beyond simple ad fraud into scam-adjacent SEO poisoning. This scale, template reuse, and cross-developer coordination is what elevates the cluster from isolated fan projects to a repeatable, automatable production pattern.

The campaign mechanics ideally suggest that threat actors posed as legitimate developers publish companion, map, guide, or cheat apps branded to GTA 6 ahead of its confirmed release, using official-style iconography and titles to capture search traffic from fans, press coverage, and trailer drops before Rockstar/Take-Two can respond.

The application further is delivered through direct Google Play Store search and listing placement. Google Play’s own “Similar apps” algorithm has been observed placing unofficial listings directly beside the genuine Rockstar “GTA V: The Manual” app, compounding confusion at the point of decision. Currently, the coordination signal is the app-store metadata indicators such as templated titles, icons, and country-distribution lists across nominally unrelated developer accounts.

• com[.]gtavicompanion[.]mobile: GTA 6 Companion & Countdown (score 100, 165 countries)

• at[.]horizonapps[.]gta6map: GTA 6 Map & Collectibles (score 100, 165 countries)

• com[.]student[.]limited[.]cheat_code_map_gta_unofficial: GTA 6 & 5 Cheat Map Unofficial (score 100)

• com[.]gta6guide[.]app: GTA 6 Guide, Cheats, Map & AI (score 94–100)

• at[.]horizonapps[.]gta: GTA 6 Cheats: Codes & Combos (score 100)

• xyz[.]gta6map[.]app: GameAssist: Map for GTA 6 (score 94)

• za[.]co[.]bluerockets[.]leonida: Leonida Navigator: GTA 6 Map (score 100)

• com[.]uroll[.]app: GTA 6 Mobile, published as “GTA Mobile Games” (score 69, direct brand impersonation)

See Appendix

• Reused pink and purple “VI” logo and palm-tree iconography mimicking official Rockstar teaser key art.

• Use of similar maps, fonts, and characters as seen consistently along with recent trailer releases.

• Byte-identical country-distribution lists (123–165 countries) shared across nominally unrelated developer accounts.

• In-app purchases enabled on apps with no underlying released product to justify payment, likely leading to financial fraud under the promise of maps, cheat codes, and guidance.

• Search-term/keyword consistencies: “gta6 forex”, “gta6 trading”, typo-variant “gtaal” embedded in listing metadata.

• Cross-category publisher reuse: e.g., BKS Student LTD simultaneously publishes an ASMR unboxing app and a drama-short AI app alongside its GTA listing, consistent with a volume app-factory model.

• Template structure: Each template at least has one or more patterns or keyword combinations such as “GTA 6/VI” + [Companion | Map | Guide | Cheats | Countdown] title pattern, generic or single-word developer names, palm-tree/VI-logo iconography.

• Typical keyword clustering: “gta6”, “companion”, “countdown”, “cheats”, “map”, “collectibles”, paired atypically with “forex”/”trading” in metadata.

• Package-name anomalies with generic or non-attributable prefixes (“xyz.”, “com[.]world[.]app1”, “com[.]uroll[.]app”) associated with low-traceability, templated submissions.

• New developer accounts reusing the same country-distribution fingerprint (123–165 countries) seen across this cluster.

• Hosting pattern: All of the applications are utilizing the standard Google Play developer console submissions, no shared backend infrastructure observed yet: signal sits at the app-store listing layer rather than network infrastructure.

• Registration cadence: multiple listings from the same developer (HorizonApps[.]at) submitted under one visual template, indicating a repeatable publishing pipeline rather than one-off releases.

Currently, given the hype around the launch, threat actors might attempt to run various profit models including ad-impression engagement (repeat opens via fake countdown timers), and potentially suggesting for malicious device permissions.

How it is used: The countdown/companion apps are structured to encourage frequent re-opens purely to serve ads against fabricated “launch day” urgency; several listings show in-app purchases enabled with no real product behind them.

This leads to multiple avenues of monetization pathways: (1) ad-impression farming, (2) hollow in-app-purchase monetization, (3) suspected SEO-poisoning pivot toward unrelated financial/trading scam content, based on “gta6 forex”/”gta6 trading” keywords.

• Financial exposure: direct consumer financial loss risk is currently associated with the pending in-app purchases, indicating monetization beyond simple ad fraud through keywords such as “trading” and “forex”.

• Account and brand compromise risk: this creates real potential for consumers to mistake these apps for official Rockstar/Take-Two products, especially where Google Play’s own recommendation engine places unofficial listings next to the genuine Rockstar app.

• Scalability of threat: 16 listings across 10+ developer identities with shared templates and identical country-distribution fingerprints indicate a low-cost, repeatable production pipeline capable of rapid re-scaling.

• Likelihood of recurrence: the popularity of the game launch leads to hype-jacking clusters and can potentially scale sharply in the 30–60 days around a confirmed product release date or major trailer drop. Therefore, a confirmed GTA 6 release date should be treated as a trigger for renewed cluster growth.

• Block or flag the 16 identified package names at the platform and endpoint level where feasible.

• Alert on newly observed Google Play listings matching the “GTA 6/VI” + companion/map/guide/cheats/countdown title pattern.

• Monitor for anomalous in-app-purchase or ad-SDK behavior on any of the flagged packages already installed in monitored environments.

• Monitor newly registered Google Play developer accounts and listings matching the identified title, iconography, and country-distribution templates.

• Flag listings that pair gaming keywords with financial-services terms (“forex”, “trading”, “invest”) in title, description, or backend search fields.

Q1: What is this threat?
A cluster of 16 unauthorized Google Play apps branding themselves as GTA 6 companion, map, guide, or cheat tools. Rockstar Games has released no official mobile app or companion product for GTA 6, so every app in this cluster is unauthorized.

Q2: Is this tied to broader monetization or scam activity?
Yes, in part. Beyond standard ad-impression and in-app-purchase monetization, at least two listings embed financial-services search terms (“gta6 forex”, “gta6 trading”), suggesting shared ASO tooling with unrelated financial-scam SEO campaigns. This has not yet been confirmed via APK-level analysis and is flagged for further investigation.

Q3: Are these apps persistent, or will they disappear on their own?
They are expected to be persistent and recurring rather than short-lived. The shared templates, cross-developer country-distribution fingerprint, and multi-listing publishers (e.g., HorizonApps[.]at) indicate an established, repeatable production pipeline. Historically, this type of hype-jacking cluster scales sharply around a confirmed product release date, so continued and renewed activity should be expected as Rockstar approaches its GTA 6 launch.