Fake PS5 Emulator Repositories Spread Password-Stealing Malware

NordVPN’s Threat Intelligence research team identified a campaign that publishes malicious GitHub repositories masquerading as the well-known AnyPS5 and Kyttyps5 emulation projects. The repositories appear to offer downloadable zip files containing a Windows executable, but the file is an infostealer that captures passwords and other personal data. The campaign leverages the recent surge in interest in running PS5 games on PC.

Fake PS5 emulators are being used to steal gamers' passwords — two well-known GitHub repos, including popular AnyPS5, get hit, infecting gamers' computers with password-scraping malware EngadgetIGN Entertainment

The payload employs several anti-analysis techniques. Upon execution it checks for sandbox indicators—less than 2 GB of RAM, virtual-machine signatures, cloud-server environments, or the absence of a physical GPU—and aborts if any are found. On a legitimate machine it adds exclusion rules to Microsoft Defender, preventing future scans. The hidden application then decrypts and runs a commercial-packed infostealer. After stealing data, a cleanup script removes the malicious files and deletes traces of the infection, typically within two minutes.

Fake PS5 emulators are being used to steal gamers' passwords — two well-known GitHub repos, including popular AnyPS5, get hit, infecting gamers' computers with password-scraping malware

NordVPN advises users to verify that a GitHub repository is owned by the official project team, to examine creation dates and review counts, and to avoid downloading files from third-party links. Keeping antivirus software enabled throughout the download and installation process is essential. If a suspected malicious download is executed, users should disconnect from the internet, run a full antivirus scan, and change passwords from a separate, clean device.

Engadget

Interest in PS5 emulation is expected to rise after the scheduled release of *GTA 6* on November 19, 2026, a console-exclusive launch that may drive more gamers to seek PC workarounds. The heightened demand could increase exposure to similar scams unless users remain vigilant.

IGN Entertainment

“Emulation fans are a perfect target. They are used to downloading experimental software from GitHub and running unsigned files, so nothing about this feels suspicious,” — Marijus Briedis, says company CTO

IGN Entertainment