Skip to content
Malware Disguised as PS5 Emulators Found on GitHub

Malware Disguised as PS5 Emulators Found on GitHub

First seen 28 Oct 2026, 20:08 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 21:08 UTC
  • •Fake PS5 emulators on GitHub are spreading malware disguised as legitimate software.
  • •The malware disables antivirus detection and collects sensitive user data.
  • •Users are advised to verify GitHub links and be cautious of new repositories.

Research by NordVPN has revealed that fake PS5 emulators on GitHub are distributing malware that steals passwords and personal data. These malicious files masquerade as legitimate software, targeting users interested in emulation. Notable names like Kyttyps5 and AnyPS5 are being used to lure victims. The malware operates stealthily, disabling Microsoft Defender's detection capabilities and executing an info-stealer that collects sensitive information. Users are advised to verify links and be cautious of newly created pages with few reviews. The rise in such threats coincides with increased interest in emulation following Sony's announcement of no further official game releases.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-28
NordVPN reports malware distribution
Fake PS5 emulators on GitHub are found to be stealing passwords and personal data, targeting emulation enthusiasts.
multiplayer.it
2026-10-28
Malware operation details revealed
The malware disables Microsoft Defender and executes an info-stealer, leaving no trace of the attack.
www.eurogamer.pt

More articles in this cluster (2)

Extracted Entities (6)

1 / 4

Common questions

How can I identify fake emulators?
Always verify the GitHub link against the official project page and check for user reviews.
What should I do if I downloaded a fake emulator?
Immediately run a full antivirus scan and change any passwords that may have been compromised.
Is this malware actively being exploited?
Yes, the malware is currently being distributed through fake emulators on GitHub.