Fake PlayStation 5 emulators circulating on GitHub are being used to distribute malware that steals passwords and other personal data, according to an investigation by NordVPN. The company's Threat Intelligence research team found that the malicious software is disguised as legitimate emulation programs. The affected listings have been made to look like the popular Kyttyps5 and AnyPS5 emulators. According to NordVPN, the pages imitate existing emulation software, which makes it likely that users will believe they are downloading the genuine product.
Marijus Briedis, NordVPN's chief technology officer, said emulation fans make an ideal target because they routinely download experimental software from GitHub and run unsigned files, so the download raises no suspicion. He said the software is not an emulator at all, describing it as a tool that takes data, evades antivirus detection and removes evidence of itself before the user notices anything wrong.
NordVPN described the sequence the malware follows after download. It first adds exclusion rules to Microsoft Defender, ensuring the software is never scanned by antivirus protection. It then installs an executable file that NordVPN believes is an infostealer, which collects passwords and any other data it can reach. A cleanup script runs at the end and deletes the malware's own files, leaving the machine's owner unaware that it was present or what it did.
The discovery comes after Sony said earlier this year that it would stop officially porting its first-party games to PC. According to the report, that decision could explain the recent popularity of emulators such as Kyttyps5, which the fake repositories are impersonating.
For US users, the findings are a reminder that software hosted on GitHub is not vetted for safety, and that downloads promising console emulation can carry hidden risks. NordVPN's research indicates that the malicious repositories were disguised as emulation software at the time of writing. The company has not said how many downloads the fake listings received or whether any of the repositories remain online.
The incident highlights the exposure created when users turn to unofficial software for functionality that hardware makers do not officially provide. Emulation software commonly requires users to run unsigned files and to bypass standard installation safeguards. Those habits, NordVPN said, are precisely what allow this kind of malware to operate without raising alarm until the data has already been taken.
More cybersecurity news from TechManNews.
