Fake PS5 Emulators on GitHub Steal Your Passwords

If you've been hunting for a PS5 emulator on GitHub, be careful what you download. NordVPN's threat intelligence team says fake GitHub repositories posing as two popular PS5 emulation projects, AnyPS5 and KytyPS5, are handing out password-stealing malware instead.

What happened

The findings were reported by Tom's Hardware and Engadget, which posted about it on X. The fake repos copy the look of the real projects and point you to a ZIP file with a Windows program inside. Here's what that program does, according to the researchers:

• It checks whether it's being watched. If the PC has under 2GB of RAM, runs in a virtual machine or on a cloud server, or has no physical GPU, it quits quietly. That's how it dodges security researchers' test machines.
• It blinds Microsoft Defender. On a real gaming PC it adds exclusion rules to Defender so its files never get scanned.
• It drops an infostealer. The final payload is packed to hide what it is, and researchers believe it's built to grab saved passwords and any other sensitive data it can reach.
• It cleans up after itself. About two minutes after infection, a script deletes the malware's files, so you may never notice anything happened.

The fake repos rotate quickly, the files use self-signed certificates made under fake company names, and GitHub may not be the only place they're showing up.

Why it matters

Emulation fans are an easy target. We're used to grabbing experimental builds from GitHub and clicking past "unknown publisher" warnings, so a fake download doesn't feel unusual. Interest in PS5 emulation is also climbing fast. GTA 6 launches on consoles on November 19, with no PC version yet, so expect a lot more of these lures in the coming weeks, along with fake "GTA 6 for PC" downloads.

It's worth saying plainly that neither emulator can play GTA 6 or most PS5 games well today. Anything promising that is a red flag.

What to do

• Only download from the official project page. Check the repo owner, star count and history, and be wary of a repo created days ago or a download link that sends you off to a file-hosting site.
• Never turn off your antivirus because an installer or a README tells you to.
• If you ran a suspicious download, disconnect from the internet, open Windows Security and check Virus & threat protection settings for any exclusions you didn't add, then run a full scan.
• Change your passwords from a different device, starting with email, Steam, PlayStation, Discord and banking, and turn on two-factor authentication.
• Waiting for GTA 6? Get your console ready instead. My guide to freeing up space on PS5 and Xbox covers that.