Fake PS5 Emulators on GitHub Deliver Password-Stealing Malware

Fake repositories impersonating two legitimate PS5 emulation projects on GitHub are distributing password-stealing malware, according to a report shared with Tom's Hardware by NordVPN's Threat Intelligence research team. The campaign targets fans of AnyPS5, a portability layer that runs PS5 games natively on Windows and Linux, and Kyttyps5, an emulator for playing PS5 titles on PCs. Both are freely available from their official GitHub repositories — which is exactly what the attackers are counting on.

Anyone who lands on one of the malicious copycat repos gets pointed to a zip file containing a Windows executable. From there, the attack unfolds in stages.

How does the malware work?

The executable unpacks a hidden application and launches a multi-stage loader. First, it checks whether it has landed on a real victim's PC or a security researcher's sandbox. The loader exits silently if the machine has less than 2GB of RAM, runs as a virtual machine, sits on a cloud-based server, or lacks a physical GPU. If the machine passes those checks, the malware adds exclusion rules to Microsoft Defender so the payload never gets scanned.

Then the payload decrypts and executes. Researchers believe it is an infostealer — malware built to harvest passwords and any other sensitive data it encounters — wrapped in a commercial packer to frustrate analysis.

The campaign shows signs of automation. The malware's self-signed certificates were created using fake company names on the same day the binaries were built, a pattern NordVPN's team flagged as evidence the operation runs at scale rather than by hand. The malicious GitHub repositories also rotate rapidly, and the researchers caution that GitHub may not be the only distribution channel.

Perhaps the most striking detail: just two minutes after infection, a cleanup script scrubs the malware's files from the machine, leaving no trace it was ever there. The password data has already left the building.

How can you avoid getting hit?

Anyone downloading tools like AnyPS5 or Kyttyps5 should verify the repository belongs to the official project team. The report recommends several checks:

• Double-check the owner of the project before downloading anything
• Be wary of download links that point to third-party destinations
• Inspect metadata such as the project's and files' creation dates for anomalies

If you've already run a suspected malicious download, disconnect the computer from the internet and run a full antivirus scan. Change your passwords from a separate device where possible — the infostealer may have grabbed credentials before the cleanup script erased the evidence.

Why is PS5 emulation a growing target?

The timing matters. PS5 emulation is likely to surge in popularity once GTA 6 launches on November 19, 2026. The game will be a console exclusive at release, with a PC version expected in early 2027, and that gap is precisely the window in which emulation seekers — and the criminals who imitate them — thrive. Expect impersonation scams around PS5 emulation tools to intensify as the release date approaches.

By Rebecca Stone