Fake PS5 emulator repositories on GitHub spread password-stealing malware

Attackers rotate the repositories quickly and clean up after infection, so checking the owner before any download matters more than usual.

NordVPN's Threat Intelligence team reports that fake GitHub repositories posing as the AnyPS5 and Kyttyps5 PS5 emulators are distributing malware aimed at stealing passwords. Once run, the payload adds Microsoft Defender exclusions so antivirus will not scan it, and then launches an executable that NordVPN believes is an infostealer. A cleanup script then deletes the malware's files about two minutes after infection, leaving little evidence it ran. The loader also checks for sandboxes and virtual machines and exits quietly if it finds one, and the repositories rotate frequently, so GitHub may not be the only distribution channel. Developers and gamers should confirm that a repository belongs to the official project owner and avoid downloads from third-party links.