Fake PS5 Emulators on GitHub Spread Password‑Stealing Malware, NordVPN Warns

Overview

According to NordVPN’s Threat Intelligence research team, malicious repositories masquerading as popular PS5 emulators have been discovered on GitHub. The fake emulators are designed to steal passwords and other personal data. As of now, the most notable impostors are named Kyttyps5 and AnyPS5.

Confirmed details

• The malicious code adds exclusion rules to Microsoft Defender, preventing antivirus scans.
• An executable file believed to be an infostealer is deployed, harvesting credentials and any accessible information.
• A cleanup script runs after the attack, deleting the malware’s own files so the victim may never notice.
• The repositories mimic legitimate emulation software, using similar naming and description to appear trustworthy.

Reported claims

• NordVPN CTO Marijus Briedis notes that emulation enthusiasts are a “perfect target” because they often download experimental software from GitHub and run unsigned files.
• The malware hides from detection, erases its tracks, and can remain invisible to the PC owner.
• The rise in popularity of unofficial emulators may be linked to Sony’s decision earlier this year to stop officially porting first‑party games to PC.

Unknowns

• The exact number of infected repositories currently active on GitHub.
• The full range of data that the infostealer can exfiltrate beyond passwords.

Practical implications and how to verify

• Verify the source: Double‑check that the GitHub link belongs to the official project team behind the emulator.
• Watch for red flags: Be cautious of repositories created recently, with few commits or reviews.
• Keep security software enabled: Do not disable antivirus protection during download or installation.
• Use official channels: Whenever possible, obtain emulators from trusted, community‑verified sources.

Broader context

Sony’s announcement that it will no longer bring its first‑party titles to PC has created a vacuum that unofficial emulators attempt to fill. While legitimate emulation projects exist, users must remain vigilant against malicious copies that exploit this demand.