NordVPN warns of fake PS5 emulators on GitHub stealing passwords

Security researchers from NordVPN have identified a malware campaign targeting gaming enthusiasts through fraudulent PlayStation 5 emulation projects on GitHub. Cybercriminals are creating look-alike repositories for popular projects such as AnyPS5 and KytyPS5 to trick users into downloading malicious software.

The malware is designed to be highly evasive. Upon execution, it checks the system environment to ensure it is running on a legitimate physical PC rather than a security researcher’s virtual machine or sandbox. If the target is deemed valid, the software creates silent exclusion rules in Microsoft Defender to prevent detection. Once active, an infostealer extracts passwords and sensitive data from the device before executing a script to delete its own files and hide its tracks.

Experts note that emulation enthusiasts are prime targets because they are accustomed to downloading experimental, unsigned software from open-source platforms. While legitimate emulation projects like KytyPS5 continue to make technical progress, users are urged to verify the authenticity of GitHub repositories and avoid downloading files from recently created or unverified sources.