Attackers disguise password-harvesting malware as popular PS5 emulators on GitHub

Cybercriminals are using fraudulent GitHub repositories to distribute password-stealing malware disguised as legitimate PlayStation 5 emulation projects, according to investigations by NordVPN's Threat Intelligence team. The malicious listings impersonate two well-known tools: AnyPS5, a portability layer designed to run PS5 games natively on Windows and Linux, and Kyttyps5, a PC emulator. Visitors downloading the software receive a zip archive containing a malicious Windows executable instead of the authentic tools. [1][2]

The malicious loader checks whether it is running in a security sandbox or virtual machine, automatically aborting if the device lacks a physical GPU, runs on a cloud server, or has less than 2GB of RAM. If installed on an everyday PC, the program injects exclusion rules into Microsoft Defender to evade detection before launching an infostealer payload. A cleanup script then deletes the installer's files just two minutes after infection, leaving virtually no visible trace on the compromised system. [1][2]

NordVPN CTO Marijus Briedis warned that emulation enthusiasts are frequent targets because they routinely download experimental, unsigned code. Interest in PS5 emulation has grown following Sony's earlier announcement that it would halt official PC ports of first-party games, as well as mounting anticipation for Grand Theft Auto 6, which launches as a console exclusive on November 19, 2026, ahead of an expected PC release in early 2027. [1][2]