Fake PS5 emulators on GitHub spread password-stealing malware

How the malware operates

According to Engadget, NordVPN’s Threat Intelligence team discovered fake PS5 emulators hosted on GitHub that install password-stealing malware. The repositories appear as legitimate emulation software, specifically mimicking tools named Kyttyps5 and AnyPS5, to trick users into downloading them.

Once executed, the malware modifies Microsoft Defender settings by adding exclusion rules. This prevents the antivirus software from scanning or detecting the malicious files, allowing the malware to operate undetected.

The malware then deploys an executable file believed to be an infostealer. This component collects passwords, sensitive personal data, and other stored credentials from the infected system.

After harvesting the data, the malware runs a cleanup script that deletes its own files. This step erases evidence of the infection, making it harder for users or security tools to trace the breach.

Why these emulators are spreading

Engadget reports that the popularity of PS5 emulators like Kyttyps5 may be linked to Sony’s decision earlier this year to stop officially porting its first-party games to PC. This move has likely increased demand for unofficial emulation tools, creating an opportunity for attackers to distribute malware disguised as legitimate software.

NordVPN’s advice for users

NordVPN’s CTO, Marijus Briedis, advises users to verify GitHub links before downloading any software, especially emulators or tools that promise access to restricted content. He also warns against disabling antivirus protections during downloads, as this can expose systems to undetected threats.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This story highlights a growing risk for gamers and developers who rely on unofficial tools like emulators. Founders building gaming software, distribution platforms, or cybersecurity tools should treat this as a signal to audit their own repositories and user education practices. The technique of evading antivirus detection by adding exclusion rules to Microsoft Defender is particularly concerning, as it could inspire copycat attacks beyond gaming. For operators, this is a reminder that malware campaigns often exploit unmet demand—like Sony’s decision to halt official PC ports—so monitoring trends in user frustration or workarounds can help anticipate security risks.

Related on Lazyfounder

• Sony
• PS5 update adds optional voice chat speaker indicator