Fake PS5 emulators on GitHub are stealing passwords, NordVPN warns
Lookalike repositories pose as AnyPS5 and KyTyPS5, switch off Defender's scanning for themselves, then delete their own tracks. Check who owns the page before you download.
AI-drafted from 2 sources. This story was written with AI from the outside reporting listed under Sources, and checked by automated tools before it went up. The originals have the full detail.
If you are hunting for a PS5 emulator on GitHub, look hard at who owns the page. Engadget reports that NordVPN's threat research team has found malicious repositories dressed up as real emulation projects, built to steal passwords and other personal data. The two disguises it names are AnyPS5 and Kyttyps5, the latter apparently KyTyPS5, a project we have covered here.
The real projects have done nothing wrong; their names are being borrowed. Engadget suggests that interest in them may have grown since Sony said earlier this year that it would stop porting its first-party games to PC.
How the fake works
According to the report, the malware goes through three steps once it is on the machine. It adds exclusion rules to Microsoft Defender so that it will not be scanned. It then deploys an executable that NordVPN believes is an infostealer. Finally a cleanup script deletes its files, leaving little for the owner to notice.
NordVPN's CTO, Marijus Briedis, puts the appeal plainly: "Emulation fans are a perfect target. They are used to downloading experimental software from GitHub and running unsigned files, so nothing about this feels suspicious."
He has a point. An early emulator usually does arrive as an unsigned build from a young repository, so the normal warning signs are weak here. Engadget's report gives no list of the fake repositories and no count of victims, and we could not find NordVPN's own write-up, so the details above rest on that report. NordVPN also sells security products, which is worth keeping in mind, though the pattern is not new.
In June, Malwarebytes described a fake GitHub project aimed at PS Vita fans, a supposed audio plugin called EQVita, with a polished README and screenshots, which used a loader called SmartLoader that can pull in password and wallet stealers such as Lumma.
What to do
Engadget's advice is to check that the GitHub link really belongs to the team behind the emulator, to be wary of lookalikes with recent creation dates and few reviews, and never to turn off your antivirus to get an install through.
If you may already have run one, Malwarebytes' advice for its own case applies well enough here: treat the computer as compromised, run a full scan with up-to-date security software, change your important passwords from a different, clean device, and review your accounts for logins you do not recognise. Because this one adds Defender exclusions, a clean scan on that machine may not prove much.