Fake GitHub repositories posing as the KytyPS5 emulator and the AnyPS5 porting tool are being used to spread password-stealing malware, according to NordVPN's Threat Intelligence team. Visitors are directed to a ZIP file containing a Windows executable that unpacks a hidden multi-stage loader.
The loader checks whether it is running on a real gaming PC and exits if the system has less than 2 GB of RAM, no physical GPU, or appears to be a virtual machine or cloud server. This behavior helps it evade sandboxes and security researchers.
On machines that pass these checks, the malware adds Microsoft Defender exclusion rules, decrypts and runs a packed payload believed to be an infostealer, then wipes its tracks roughly two minutes later. Its self-signed certificates use fake company names and were created the same day the malware was built, suggesting an automated campaign.
NordVPN CTO Marijus Briedis noted that emulation enthusiasts are ideal targets since they are accustomed to downloading experimental software from GitHub. Users are advised to verify repository ownership, check creation dates, avoid third-party download links, and run full scans if they executed any of these files.
Source: TechPowerUp News · Summarized by HeadlinesBriefing