NordVPN’s Threat Intelligence research team has identified an active fraudulent campaign promoted through malicious GitHub repositories, spreading malware disguised as legitimate PlayStation 5 emulation and porting software for PC.
The campaign fraudulently exploits the names of two well-known projects in the emulation community. AnyPS5 is a portability layer designed to convert and run PS5 games as native executables on Windows and Linux, which gained significant visibility for reverse engineering 100% of the console’s GPU shaders and around 90% of its system libraries.
Kyttyps5 is a PS5 emulator targeted at PCs. Both projects have attracted strong interest from gamers eager to play PS5 titles without owning the console.
Users who visit the malicious repositories are directed to download a zip file containing a Windows executable. The campaign is distributed through rapidly rotating GitHub repositories and is likely extended to other code-hosting sites.
Malware that checks if anyone is watching
The downloaded file is a portable installer that unpacks a hidden application and launches a multi-stage loader. Before doing anything malicious, it checks whether it is running on a real victim’s machine or in a security researcher’s sandbox. It exits silently if the computer has less than 2 GB of RAM, runs on a virtual machine, uses a cloud server, or lacks a physical graphics card.
If the checks pass, the malware quietly adds exclusion rules to Microsoft Defender so the antivirus will never scan the folders where it operates. It then decrypts and runs its final payload, an executable protected by a commercial packer that NordVPN’s analysts believe is an infostealer, a type of malware designed to steal passwords and other sensitive data. The payload is not yet documented in any public source.
Both analyzed samples were signed with self-signed certificates using fake company names, issued on the same day the malware was built. This points to automated, campaign-driven generation of the files. Two minutes after infection, the malware runs a cleanup script that deletes its own files, leaving almost no evidence behind.
How to stay safe
NordVPN advises gamers and emulation enthusiasts to keep these rules in mind:
- Verify you’re on the real project’s page. Scammers copy the names and reputations of legitimate tools like AnyPS5 and Kyttyps5. Check that the repository belongs to the official project team, and be wary of lookalike repos with few stars, recent creation dates, or download links leading elsewhere.
- Do not disable your antivirus or ignore its warnings. If a file requires you to exclude it from Windows Defender to run, it is almost certainly malicious.
- Watch for red flags after installation. Real emulators have a visible interface. Software that runs with no window and no sign of activity is a warning sign.
- If you have run a suspicious file, disconnect from the internet, change your passwords from a different device, and run a full antivirus scan.
Methodology
NordVPN’s Threat Intelligence team analyzed two samples of the malicious installer, built a day apart starting from October 10th. Analysts examined the malware’s multi-stage infection chain and documented its anti-analysis checks, Windows Defender evasion techniques, and self-deletion behavior. The team also mapped the attack infrastructure behind the campaign, including email accounts and services used by the operators.
Related
This entry was posted on October 28, 2026 at 10:20 am and is filed under Commentary with tags NordVPN. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Fake PS5 emulators on GitHub infect gamers with password-stealing malware
NordVPN’s Threat Intelligence research team has identified an active fraudulent campaign promoted through malicious GitHub repositories, spreading malware disguised as legitimate PlayStation 5 emulation and porting software for PC.
The campaign fraudulently exploits the names of two well-known projects in the emulation community. AnyPS5 is a portability layer designed to convert and run PS5 games as native executables on Windows and Linux, which gained significant visibility for reverse engineering 100% of the console’s GPU shaders and around 90% of its system libraries.
Kyttyps5 is a PS5 emulator targeted at PCs. Both projects have attracted strong interest from gamers eager to play PS5 titles without owning the console.
Users who visit the malicious repositories are directed to download a zip file containing a Windows executable. The campaign is distributed through rapidly rotating GitHub repositories and is likely extended to other code-hosting sites.
Malware that checks if anyone is watching
The downloaded file is a portable installer that unpacks a hidden application and launches a multi-stage loader. Before doing anything malicious, it checks whether it is running on a real victim’s machine or in a security researcher’s sandbox. It exits silently if the computer has less than 2 GB of RAM, runs on a virtual machine, uses a cloud server, or lacks a physical graphics card.
If the checks pass, the malware quietly adds exclusion rules to Microsoft Defender so the antivirus will never scan the folders where it operates. It then decrypts and runs its final payload, an executable protected by a commercial packer that NordVPN’s analysts believe is an infostealer, a type of malware designed to steal passwords and other sensitive data. The payload is not yet documented in any public source.
Both analyzed samples were signed with self-signed certificates using fake company names, issued on the same day the malware was built. This points to automated, campaign-driven generation of the files. Two minutes after infection, the malware runs a cleanup script that deletes its own files, leaving almost no evidence behind.
How to stay safe
NordVPN advises gamers and emulation enthusiasts to keep these rules in mind:
Methodology
NordVPN’s Threat Intelligence team analyzed two samples of the malicious installer, built a day apart starting from October 10th. Analysts examined the malware’s multi-stage infection chain and documented its anti-analysis checks, Windows Defender evasion techniques, and self-deletion behavior. The team also mapped the attack infrastructure behind the campaign, including email accounts and services used by the operators.
Share this:
Like this:
Related
This entry was posted on October 28, 2026 at 10:20 am and is filed under Commentary with tags NordVPN. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.