Fake PS5 emulators on GitHub distribute password-stealing malware

By One Percent LowsOct 29, 2026, 9:58 PM ETCovered by 3 outlets

TL;DR

Fake PS5 emulator repositories on GitHub are targeting PC gamers with infostealer malware disguised as the KyTyps5 and AnyPS5 projects, according to NordVPN.

NordVPN Threat Intelligence reports that malicious GitHub repositories disguised as the KyTyps5 and AnyPS5 PlayStation 5 emulators are infecting Windows PCs with infostealer malware.

Fake PS5 emulators on GitHub distribute password-stealing malware

Image: TechSpot

Gamers downloading the software receive ZIP archives containing Windows executables. After execution, the program modifies Microsoft Defender configurations to prevent scanning while harvesting credentials, session cookies, and personal details.

To conceal the intrusion, a cleanup script removes the malicious files about two minutes following execution. The executables utilize self-signed certificates with fictitious company names generated when the program was created.

Security specialists recommend confirming download links with official developers, avoiding new repositories with minimal feedback, and keeping security software enabled.

Fake PS5 emulators on GitHub distribute password-stealing malware

TL;DR

Earlier coverage