Fake PS5 emulators on GitHub spread password-stealing malware

Security specialists from NordVPN have uncovered a wave of malicious repositories on GitHub that falsely claim to be projects for running PlayStation 5 games on Windows PCs. These fake repositories specifically target gamers by impersonating well-known emulation solutions like AnyPS5 and KytyPS5.

How the fake PS5 emulator scam operates - Attackers set up fraudulent repositories mimicking legitimate tools such as AnyPS5 and KytyPS5. - Users are enticed to download ZIP archives containing Windows executable files promising advanced emulation features. - Upon execution, the malware automatically adds exclusion rules to Microsoft Defender to bypass security detection. - The payload is then decrypted and executed to deploy password-stealing information loggers.

Attack mechanics and stealth cleanup process According to the researchers, the final executable is a specialized info-stealer designed to harvest user passwords, login credentials, and other sensitive personal data stored on the infected machine. To hinder forensic investigation and evade detection, a cleanup script is triggered approximately two minutes after the initial launch, successfully removing all traces of the malware binaries from the system storage.

How to stay safe from malicious repositories To avoid falling victim to such deceptive campaigns, users must always verify the authenticity of software authors and repository origins. For instance, verified public information shows that AnyPS5 is maintained by the user boykopovar, while the official KytyPS5 repository belongs to the KytyPS5 organization. This incident highlights the ongoing risks associated with downloading unverified software, game emulators, and tools from open-source platforms without proper verification, emphasizing the importance of robust cybersecurity practices.