Malicious repositories pretending to offer popular PS5 emulation tools have been found spreading malware reported to steal passwords, according to a report by NordVPN's Threat Intelligence research team. The malware's payload is believed to be an infostealer, a type of malware that can steal passwords and other sensitive data. The campaign targets users looking for AnyPS5 and Kyttyps5, two legitimate projects for running PlayStation 5 games on PC.
The fake repositories masquerade as the tools but direct users to download a zip file containing a Windows executable. The GitHub repositories rotate rapidly, and the report says GitHub may not be the only source.
The malicious executable first unpacks a hidden application, then launches its multi-stage loader. The loader checks whether the PC is a legitimate machine or a security researcher's sandbox. It exits silently if it detects less than 2GB of RAM, a virtual machine, a cloud-based server, or the absence of a physical GPU. If the machine is deemed a legitimate target, the malware adds exclusion rules to Microsoft Defender to avoid being identified during antivirus scans. The final payload, a packed executable believed to be an infostealer, is then decrypted and run.
A cleanup script scrubs the affected computer of the malware's files just two minutes after infection, leaving no trace that it was ever present. The self-signed certificates used by the malware were created with fake company names on the same day the malware was built, suggesting the campaign may be automated.
AnyPS5 is a portability layer that lets PS5 games run as native applications on Windows and Linux; Kyttyps5 is an emulator for playing PS5 games on PC. Both are freely available through their respective GitHub repositories. Users are advised to verify that a repository belongs to the official project team, check for download links that use third-party destinations, and review file metadata such as creation dates. Anyone who has accessed a suspected malicious download should disconnect from the internet, run a full antivirus scan, and change passwords from a separate device where possible.
Analysis
Why This Matters
- Gamers seeking PS5 emulation tools are the primary target, and the malware's anti-analysis features make it hard for security researchers to detect.
- The rapid rotation of malicious repositories and automated certificate generation suggest an organised operation that could evade takedown efforts.
- Password theft from such attacks can lead to broader account compromise across gaming platforms and linked services.
Background
PS5 emulation has become increasingly sought after as console-exclusive titles such as Grand Theft Auto VI drive demand for PC play. Both AnyPS5 and Kyttyps5 are well-known projects within the emulation community, making them attractive names for scammers to impersonate. Malware campaigns targeting open-source project downloaders have been a recurring tactic, exploiting users' trust in repositories on platforms like GitHub.
What to Watch
- Whether GitHub removes the fraudulent repositories and whether the attackers respond with new accounts or alternative distribution methods.
- Any official statements from the AnyPS5 or Kyttyps5 projects warning users about the fake repositories.
- Possible expansion of the campaign to target other popular emulation or gaming tools.
Checked
11 claims in this story checked against 1 source: 10 supported.
Show each claim
- SupportedFake PS5-emulator repositories on GitHub spread malware that steals passwords.Latest from Tom's Hardware: “Malicious GitHub repositories masquerading as two well-known and legitimate PS5 game emulation tools have been identified as spreading malware that steals gamers' passwords.”
- Partly supportedThe report was by NordVPN's Threat Intelligence research team.Latest from Tom's Hardware: “according to a report shared with Tom's Hardware by NordVPN's Threat Intelligence research team.”
- SupportedThe payload is believed to be an infostealer capable of stealing passwords and other sensitive data.Latest from Tom's Hardware: “That payload, we're told, is an executable protected by a commercial packer that is believed to be an infostealer — a type of malware whose job it is to steal passwords as well as any other sensitive data that it comes across.”
- SupportedThe campaign targets users looking for AnyPS5 and Kyttyps5.Latest from Tom's Hardware: “The campaign trades on the back of the popularity of two projects that have become popular within the PS5 emulation community. AnyPS5 is a portability layer”
- SupportedThe fake repositories direct users to a zip file containing a Windows executable.Latest from Tom's Hardware: “users who visit one of the malicious repositories posing as these tools are directed to download a zip file containing a Windows executable.”
- SupportedThe campaign's GitHub repositories rotate rapidly, and GitHub may not be its only source.Latest from Tom's Hardware: “Notably, the GitHub repositories used as part of the malware campaign rapidly rotate, and it's possible that GitHub is not the only source.”
- SupportedThe executable unpacks a hidden application before launching a multi-stage loader.Latest from Tom's Hardware: “The malicious executable unpacks a hidden application before launching its own multi-stage loader.”
- SupportedThe loader exits silently if it detects less than 2GB of RAM, a virtual machine, a cloud-based server or no physical GPU.Latest from Tom's Hardware: “If any of those criteria are met, the loader exits silently.”
- SupportedIf the machine is deemed a legitimate target, the malware adds exclusion rules to Microsoft Defender to avoid detection during scans.Latest from Tom's Hardware: “If the machine is deemed to be a legitimate target, the malware adds exclusion rules to Microsoft Defender to ensure that it will never be scanned and identified during an antivirus scan.”
- SupportedA cleanup script removes the malware's files two minutes after infection, leaving no trace it was present.Latest from Tom's Hardware: “Just two minutes after infection, a cleanup script scrubs the affected computer of the malware's files, leaving no trace that it was ever present”
- SupportedThe malware's self-signed certificates used fake company names and were created on the same day the malware was built, suggesting the campaign may be automated.Latest from Tom's Hardware: “The malware uses self-signed certificates, created using fake company names and on the same day the malware was built — suggesting that the malware campaign may be automated.”
