Malicious actors are distributing fake PlayStation 5 emulators on GitHub that carry password-stealing malware, according to an investigation by the threat research arm of NordVPN. These fraudulent programs masquerade as authentic emulation software to trick unsuspecting users into downloading them.
How the Fake Emulators Target Users
The malicious GitHub repositories specifically mimic existing, well-known emulation tools. As reported by Engadget based on the investigation, threat actors have disguised their harmful software using the names of popular emulators such as Kyttyps5 and AnyPS5.
Marijus Briedis, the Chief Technology Officer at NordVPN, explained to Engadget that gamers looking for emulators represent an ideal target for these campaigns. Users within this community frequently download experimental projects directly from GitHub and execute unsigned files, making the infection process appear completely normal.
Briedis described the operation to Engadget by stating, “Emulation fans are a perfect target. They are used to downloading experimental software from GitHub and running unsigned files, so nothing about this feels suspicious. But this is not an emulator. It steals your data, hides from your antivirus and erases its own tracks before you notice anything is wrong.”
The Infection Process and Prevention
Once a victim downloads the fake software, the malware immediately inserts exclusion rules into Microsoft Defender to prevent the system’s built-in antivirus from scanning the infected files. The program then executes what NordVPN identifies as an infostealer, which targets stored passwords and various other sensitive personal information.
After harvesting the targeted data, the software executes a cleanup script that removes its installation files from the computer, leaving victims unaware that a breach occurred. To protect against these threats, cybersecurity experts advise users to thoroughly verify that GitHub download links connect directly to the official project teams. Individuals should exercise caution with lookalike repositories that feature recent creation dates and minimal reviews, and they must never disable their antivirus software during software installation.
The rise in demand for unofficial emulation tools follows an announcement earlier this year by Sony indicating an end to official PC ports for its first-party games, a shift that likely drove increased interest in alternative software like Kyttyps5.
