Malicious PS5 Emulator Repositories Distributing Password-Stealing Malware

• •Fake PS5 emulators on GitHub are spreading malware that steals personal data.
• •The malware modifies Microsoft Defender settings to avoid detection.
• •Users are advised to verify repository authenticity before downloading.

Researchers from NordVPN have identified GitHub repositories masquerading as PS5 emulators, specifically Kyttyps5 and AnyPS5, that distribute malware capable of stealing passwords and personal data. The malware evades detection by adding exclusion rules to Microsoft Defender, preventing antivirus scans. After installation, it deploys an executable designed to collect sensitive information and subsequently deletes its own files to cover its tracks. Users are particularly vulnerable as they often download experimental software from GitHub without suspicion. NordVPN advises caution when downloading software from GitHub, emphasizing the need to verify repository authenticity. This incident follows Sony's decision earlier in 2026 to cease official PC ports of its first-party games, potentially driving interest in emulators. Microsoft has also suspended access to multiple GitHub repositories due to similar malware concerns.