Fake PS5 Emulator Repos Infect Gamers

Attackers created fake GitHub repositories that copied the names of PS5 emulator projects, luring gamers searching for ways to play PS5 games on a PC. The ZIP downloads did not contain working emulators; they launched malware that evaded analysis, attempted to weaken Microsoft Defender protections, and likely stole sensitive information.

Key findings

• Attackers used look-alike GitHub repositories impersonating the AnyPS5 and KytyPS5 emulator projects.
• Victims were lured by searches for unofficial PS5 emulators and downloaded malicious ZIP files.
• The malware checked for virtual machines, cloud environments, low-memory devices, and systems without a physical GPU before proceeding.
• On suitable systems, the malware attempted to add its installation location to Microsoft Defender exclusions.
• A later-stage executable was believed to be an infostealer that collects sensitive information from infected computers.
• The original AnyPS5 project warned users, but the article reports that victims had already downloaded the impersonating repository.

Who’s being targeted

• Commonly targeted roles: Gamers, Developers, Employees who install open-source or community software, IT support and endpoint security teams.
• Affected industries: Gaming, Software and open-source development, Consumer technology.
• Attack channels: website.
• Impersonated: AnyPS5 or KytyPS5 emulator project.

Awareness takeaways

• Verify that software downloads come from the official project website or the developer’s verified GitHub account before downloading or running them.
• Do not assume a download is safe simply because it is hosted on GitHub or another well-known platform.
• Treat requests to disable antivirus protection, change security settings, or add exclusions as a stop sign, not a normal installation step.
• If a suspicious download was run, disconnect the device and change potentially exposed passwords from a separate trusted device.

Red flags to watch for

• The repository imitates a familiar project name but is not owned by the official developer.
• The project is newly created or has little credible release history.
• The download is unavailable through the project’s official website or established communication channels.