Nord VPN's Threat Intelligence research team discovered malicious GitHub repositories disguised as legitimate PS5 emulators like Kyttyps5 and Any PS5. These fake emulators are designed to steal passwords and personal data while evading detection. The malware adds exclusion rules to Microsoft Defender, deploys an infostealer executable, then deletes itself to avoid detection.
According to CT O Marijus Briedis, emulation enthusiasts are perfect targets because they're accustomed to downloading experimental software from GitHub and running unsigned files. The deceptive listings mimic existing emulation software, tricking users into believing they're downloading legitimate tools. This surge in fake emulators may be linked to Sony's decision earlier this year to stop officially porting first-party games to PC, making PS5 emulation more popular.
To stay safe, users should verify GitHub links are affiliated with official project teams, avoid lookalike repositories with recent creation dates and few reviews, and never disable antivirus software during download or installation.
Source: Engadget · Summarized by HeadlinesBriefing