As interest in running PlayStation 5 games on PC grows, attackers are using GitHub to spread fake emulator projects. NordVPN’s Threat Intelligence team says some of these schemes imitate the names, appearance and documentation of known projects such as KytyPS5 and AnyPS5 to make downloads seem legitimate.
The files are offered as ZIP archives containing a Windows executable that claims to install an emulator. Instead, the program checks whether it is running on a real computer and, if the machine appears to be a gaming PC, quietly adds exclusions to Microsoft Defender so the antivirus will not scan the folders involved.
The malware then deploys an information stealer designed to collect login details, browser passwords and sessions for gaming services including Steam, EA and Epic Games. According to the investigation, an automated cleanup script can remove the malicious files from the hard drive within two minutes, leaving users with little immediate evidence of the infection.
The warning comes as PS5 emulation is attracting more attention. The source reports that KytyPS5 has recently run games including the Demon’s Souls remake at 40 to 50 frames per second and GTA V at up to 60 frames per second, depending on the PC.
Emulation itself is not necessarily illegal, but it can become so when it involves bypassing technical protections or using illegally obtained game copies. The scams also show the security risks of downloading purported emulators from unverified projects.
Sources: Jeuxvideo.com.