PS5 Emulator Malware Hides in Fake AnyPS5 and KytyPS5 Repos
A new PS5 emulator malware campaign is using fake GitHub repositories that impersonate AnyPS5 and KytyPS5, two popular tools for running PlayStation 5 games on PC, to plant a suspected password stealer on Windows machines. NordVPN’s Threat Intelligence team disclosed the campaign this week. The lookalike pages have been removed, but the repositories rotate quickly and may reappear.
The bait is well chosen. PS5 emulation is booming, with projects like the Demon’s Souls PS5 emulator milestone drawing gamers who want console exclusives on PC.
How the PS5 Emulator Malware Works
Fake repositories tell visitors to download a ZIP archive that contains a Windows executable. Once launched, it unpacks a hidden application and starts a multi-stage loader, per NordVPN findings first reported by Tom’s Hardware.
The loader first checks whether it is running on a real gaming PC. It exits silently if the system has less than 2 GB of RAM, runs inside a virtual machine or on a cloud server, or has no physical graphics card. The checks help it dodge researchers’ analysis sandboxes.
On a machine that passes, the malware:
- adds Microsoft Defender exclusions so scans skip its files,
- decrypts and runs a payload protected by a commercial packer, which NordVPN believes is an infostealer built to grab passwords and other sensitive data,
- runs a cleanup script about two minutes later that deletes its own files.
As Engadget notes, the files use self-signed certificates with fake company names created the same day the malware was built, suggesting the campaign may be automated. NordVPN has not named the infostealer or said how many people were hit.
NordVPN CTO Marijus Briedis said, “Emulation fans are a perfect target. They are used to downloading experimental software from GitHub and running unsigned files, so nothing about this feels suspicious. But this is not an emulator. It steals your data, hides from your antivirus and erases its own tracks before you notice anything is wrong.”
What AnyPS5 and KytyPS5 Actually Are
AnyPS5 ports PS5 executables to run natively on Windows and Linux. Its official home is the boykopovar/AnyPS5 repository, which has more than 50,000 stars.
KytyPS5 is a PS5 emulator for Windows that has run the PS5 version of GTA 5 at up to 60 fps, according to TechPowerUp. Its official repository is under the KytyPS5 GitHub organization. The PS5 scene is busy on the console side too, where jailbroken PS5 consoles now run Windows 7.
Abusing a trusted name is a familiar trick. Gamers were targeted the same way by fake GTA 6 beta downloads.
How to Stay Safe
Before downloading any emulator, check that the repository belongs to the official project, and be wary of new repositories or download links that point to outside websites. Keep your antivirus on during installation.
If you ran a file from a lookalike page, disconnect the PC from the internet, run a full antivirus scan and change your passwords from a different, clean device. Also check Defender’s exclusion list for entries you did not add.
Your comment has been submitted,
it will be published after approval.