Gamers searching GitHub for PS5 emulation software have been targeted by a malware campaign built on a straightforward deception: fake repositories designed to closely resemble legitimate projects. NordVPN’s Threat Intelligence team identified malicious repositories impersonating KytyPS5 and AnyPS5, two real PS5-related projects.
The fake pages directed visitors to download ZIP archives containing Windows executables, not functional emulators. Attackers may have relied on GitHub’s trusted reputation among developers and hobbyists, along with the expectation that experimental emulation software is often unsigned.
How the Infection Chain Works
The malware disables a key layer of Windows protection before a suspected data-theft tool runs in the background.
After a user runs the executable, the malware performs environment checks and then adds exclusion rules to Microsoft Defender, Windows’ built-in antivirus. Those exclusion rules instruct Defender to skip designated files or locations during scans, reducing its protection for those items.
A suspected infostealer then launches. Researchers believe the payload is an infostealer, a type of malware designed to steal credentials and other sensitive information, though its full data-collection scope has not been publicly confirmed by NordVPN.
The malware’s environment checks may prevent it from executing on virtual machines, cloud systems, or computers with less than 2 GB of RAM. Machines without a physical graphics card may also be excluded, which can make automated security analysis harder.
A cleanup script then deletes the malware’s files, potentially within two minutes of execution. By the time a victim notices anything unusual, the files may already be gone.
Self-Signed Certificates Made the Files Look Legitimate
Fabricated credentials gave the malicious executables a veneer of legitimacy before any code ran.
The malicious executables used self-signed certificates and fabricated publisher names, which could make them appear more legitimate to an unsuspecting user. A self-signed certificate is one the attacker created without verification from a trusted authority.
Some Repos Removed, But the Threat Persists
NordVPN warns that similar campaigns can resurface quickly under new repository names.
GitHub has removed some of the malicious repositories, according to NordVPN’s researchers. They warn that similar campaigns can reappear quickly on GitHub or other code-hosting platforms, with attackers standing up new repositories under different names, much like secretly tracking users through deceptive software that resurfaces under new guises.
How to Verify Before You Download
Confirming repository ownership and scrutinizing download sources are the most direct defenses against this type of campaign.
Before downloading any emulation software from GitHub, confirm the repository belongs to the actual developer. Check the account’s creation date, review its history of sustained activity, and compare the download link against the project’s official channels.
Treat any third-party download link with skepticism, and do not disable antivirus software during installation regardless of instructions bundled with a download. A request to disable antivirus protection is a major warning sign and should be independently verified. Reviewing resources on how to stay safe against hidden attack vectors can also help reinforce good security habits.
If you executed a file from a suspicious repository, disconnect the affected computer from the internet immediately, then run a full security scan. Change your passwords from a separate, trusted device before reconnecting the compromised machine to any accounts.
