Searching for a PS5 emulator for your PC is now a good way to end up with malware. NordVPN’s Threat Intelligence team says it has found an active campaign that uses fake GitHub repositories, dressed up as PS5 emulation software, to push a password-stealing program onto Windows machines.
The repositories copy the names of two real projects, AnyPS5 and Kyttyps5, and send visitors to a zip file with a Windows executable inside. The pages rotate quickly, and the researchers think the same trick may be running on other code-hosting sites too.
What happens after you run it
Run the zip’s executable and a hidden program starts a loader that works in several stages. The first thing it does is check whether anyone is watching. It quits quietly on machines with less than 2GB of RAM, on virtual machines, on cloud servers and on PCs with no physical graphics card.
On a machine that passes those checks, it adds exclusions to Microsoft Defender so its files are not scanned, then decrypts and runs the final payload. NordVPN believes that payload is an infostealer, though it is not yet publicly documented. Roughly two minutes in, a script wipes the files it dropped, so an infected PC shows few signs afterwards.
NordVPN studied two builds of the installer compiled a day apart, from 10 October. Each carried a certificate the attacker signed themselves, under an invented company name and dated the day of the build, which NordVPN reads as a sign the process is automated. In its coverage of the research, Engadget noted that Sony’s recent decision to stop bringing its first-party games to PC may be adding to the hunger for emulators.
How to avoid it
- Check that a GitHub repository belongs to the emulator’s real project team. Be suspicious of new repositories with few stars or reviews.
- Do not turn off your antivirus to install something. Treat any prompt to exclude a file from Defender as a red flag.
- Be wary of an “emulator” that runs with no window or visible activity.
If you have already run something like this, NordVPN says to go offline first, then change your passwords on another device and scan the PC with your antivirus. Because infostealers typically target saved browser logins, change the passwords for email and banking accounts first.
The safest rule is the plain one: if a PS5 emulator promises to run console games on a PC today, treat the download as suspect until its source has been checked.
