Fake PS5 emulators on GitHub are spreading password-stealing malware

Fake PS5 emulators infected with malware have been floating around GitHub, according to an investigation by NordVPN. The company's Threat Intelligence research team found that the malware is disguised as legitimate emulation software and works to steal passwords and other personal data.

The listing pages mimic existing emulation software, which is likely to trick people into thinking they're downloading the real thing. As of this writing, malicious GitHub repositories have been disguised as the popular Kyttyps5 and AnyPS5 emulators.

"Emulation fans are a perfect target. They are used to downloading experimental software from GitHub and running unsigned files, so nothing about this feels suspicious," says company CTO Marijus Briedis. "But this is not an emulator. It steals your data, hides from your antivirus and erases its own tracks before you notice anything is wrong."

Here's how it works. Once downloaded, the malware adds exclusion rules to Microsoft Defender, so it'll never be scanned by antivirus software. Next, it deploys an executable file NordVPN believes is an infostealer that scoops up passwords and anything else it can get its hands on. Finally, the software runs a cleanup script that deletes its own files. The PC's owner would never know it was there and what it did. Scary stuff.

The best way to avoid the issue is to double and triple check that the GitHub link you're downloading from is affiliated with the project team behind the emulator. Be wary of lookalikes with recent creation dates and a small number of reviews. Also, do not disable antivirus software throughout the download and installation process.

Sony announced earlier this year that it would no longer be officially porting its first party games to PC. This could account for the recent popularity of emulators like Kyttyps5.