Malicious GitHub Repos Disguised as PS5 Emulators Found Stealing Credentials

NordVPN’s threat intelligence team has identified malicious GitHub repositories disguised as PS5 emulator software, according to the company’s security researchers.

The packages appear to impersonate popular emulation projects, including Kyttyps5 and AnyPS5, making it easier for users to mistake the files for legitimate downloads. According to NordVPN, the software is designed to steal passwords and other personal data after it reaches a victim’s system.

How the malware operates

Once installed, the malware reportedly adds exclusion rules to Microsoft Defender so future scans will not detect it. It then deploys an executable that NordVPN believes functions as an infostealer, collecting passwords and other sensitive information accessible on the machine.

The attack is designed to be short-lived and difficult to trace. After the data theft, the package is said to run a cleanup script that removes its own files, leaving little evidence for the user to investigate.

Why emulation fans are targeted

NordVPN said the malware preys on the habits of people who regularly download experimental software and run unsigned files from open-source platforms. The company’s CTO described the threat as deceptive because the repository pages resemble real emulator projects, while the payload behaves like a data-stealing tool rather than legitimate emulation software.

What users should check

Security guidance from the report emphasizes verifying that any GitHub repository is connected to the actual development team behind the emulator. Users are advised to be cautious with lookalike pages, especially those created recently or with limited community feedback. Antivirus protection should also remain enabled during the download and installation process.

The issue arrives as interest in PS5 emulation has grown, partly due to changes in how Sony handles PC releases. The company said earlier this year that it would no longer officially port first-party games to PC, a move that has increased attention on alternative ways to play PlayStation titles on other systems.