Tech · 5 d ago
Fake PS5 emulators on GitHub are used to steal gamers' passwords
Malicious GitHub repositories posing as two popular PS5 emulation tools, AnyPS5 and Kyttyps5, spread malware that steals passwords, according to NordVPN's threat researchers.
How it works
- Fake repository offers a zip file
- Loader checks for a research sandbox
- Adds Microsoft Defender exclusions
- Infostealer runs, then files are wiped
The download is a zip file with a Windows program that avoids sandboxes, excludes itself from Microsoft Defender scans and then installs an infostealer. Two minutes later a cleanup script removes its files.
What to do
Check that a repository belongs to the official project and watch for third-party download links. If infected, disconnect from the internet, run a full scan and change passwords from another device.
