Fake PS5 emulators on GitHub: beware of malware

Fake GitHub repositories imitate the PS5 emulators AnyPS5 and KytyPS5 to install software that steals passwords and personal data.


A campaign targeting emulation

The threat research team at NordVPN reported on October 28 a campaign aimed at emulation fans. Fake GitHub repositories copy the name and look ofAnyPS5 and KytyPS5, two very real projects we have already covered.


How it works

• The fake repository offers a ZIP archive containing an executable.
• Once run, it adds exclusions to Microsoft Defender, so it is no longer scanned.
• It then installs a data stealer ("infostealer"): passwords and other personal information.
• Finally, it deletes its own files to cover its tracks.

According to NordVPN's CTO, Marijus Briedis, emulation fans are ideal targets: used to downloading experimental software and running unsigned files, they see nothing suspicious.


The right repositories

The real projects are boykopovar/AnyPS5, which is close to 50,000 stars, and KytyPS5/KytyPS5, which has more than 10,000, both under the GPL-2.0 license. Before downloading:

• check the exact account and repository name, and be wary of recent or little-followed copies;
• only download from the "Releases" tab of the official repository;
• an "emulator" delivered as a plain executable in a ZIP, which asks you to disable your antivirus, should raise a red flag.

If you ran such a file: check your Defender exclusions, run a full scan, and change your passwords from another device. NordVPN has not published the names of the fake accounts. The same method also targets the Switch 2, with fake jailbreak tools.


Sources: Engadget · Pirat_Nation (X) · AnyPS5 (GitHub) · KytyPS5 (GitHub)