Fake PS5 Emulators on GitHub Hide Password-Stealing Malware

Fake PS5 emulators malware is making the rounds on GitHub, according to new research from NordVPN’s Threat Intelligence team. The repositories look like legitimate emulation projects, but once downloaded, they quietly install software built to steal passwords and other personal data while hiding from antivirus tools.

What NordVPN Found

NordVPN’s researchers identified malicious GitHub repositories mimicking two well-known PS5 emulation projects, Kyttyps5 and AnyPS5. The fake listings are designed to look convincing enough that someone searching for emulation software would have little reason to suspect anything is wrong, especially since downloading unsigned, experimental files is already normal behavior in that community.

Company CTO Marijus Briedis put it bluntly, explaining that emulation fans make for an easy target because they’re already used to running unsigned software from GitHub without a second thought. According to Briedis, this isn’t an emulator at all. It steals data, hides from antivirus software, and erases its own tracks before the victim notices anything happened.

How the Fake Emulators Operate

The infection chain NordVPN describes happens in three stages. First, the malware adds exclusion rules to Microsoft Defender so the malicious files are never scanned. Next, it drops an executable that researchers believe functions as an infostealer, designed to grab saved passwords and whatever other sensitive data it can reach on the machine. Finally, a cleanup script deletes the malware’s own files, leaving little evidence behind for the PC’s owner to find.

That combination is worth taking seriously. It’s not just a nuisance pop-up or a broken download; it’s software built specifically to avoid detection while quietly harvesting credentials, which could affect anything from gaming accounts to banking logins stored in a browser.

Why Emulation Fans Are a Prime Target

PS5 emulation has become a more popular topic recently. Sony announced earlier this year that it would stop officially porting its first-party games to PC, and that decision appears to have fueled renewed interest in emulators like Kyttyps5 as an alternative way to play those titles. More interest means more searches, more downloads, and more opportunities for scammers to slip fake projects into the mix. It’s a similar dynamic to what’s played out in other corners of the console scene, including the Nintendo Switch 2 jailbreak community, where enthusiasm for unofficial software creates an audience that’s primed to download experimental tools without much hesitation.

How to Protect Yourself

NordVPN’s advice boils down to a few practical habits that apply well beyond this specific case:

• Double- and triple-check that a GitHub repository is actually affiliated with the real project team behind an emulator before downloading anything.
• Be suspicious of lookalike repositories with recently created pages and very few reviews or stars.
• Never disable your antivirus software to “make installation easier,” since that’s exactly the kind of prompt malware relies on.
• Keep an eye on unexpected changes to your antivirus settings, like new exclusion rules you didn’t create yourself.

If you’ve already run software you now suspect might be fake, changing your passwords from a different, clean device and turning on two-factor authentication is a reasonable next step, even if the malware itself is designed to disappear.

The Bottom Line

Fake PS5 emulators malware is a reminder that any corner of the internet built around downloading unofficial software is also a prime hunting ground for attackers. With Sony stepping back from PC ports and interest in PS5 emulation growing, it’s worth being extra cautious about where you get emulation tools from, and treating any repository you can’t verify as suspicious by default.

Source: Engadget

Where to buy

Malwarebytes StandardBuy on Amazon: Malwarebytes Standard

• NordVPN Threat Protection Subscription: check price on Amazon

As an Amazon Associate I earn from qualifying purchases.