What we know so far: Fake PlayStation 5 emulators hosted on GitHub are delivering malware that alters Microsoft Defender settings before launching a suspected data-stealing program. The campaign exploits gamers' willingness to experiment with unofficial software, making malicious downloads look like a normal part of the process. It highlights how familiar project names can earn users' trust before they verify who is behind the files.
A cleanup script deletes the malware's own files, making the intrusion harder for the PC's owner to detect. NordVPN's Threat Intelligence team discovered malicious repositories posing as the KyttyPS5 and AnyPS5 emulators. Their pages mimic legitimate emulation projects, giving users the impression that they are downloading gaming software. NordVPN warns that the downloads instead put passwords and other personal information at risk.
The disguise targets an audience accustomed to experimenting with unfinished software. Users looking for experimental emulators may expect to download builds from GitHub and run files that have not been digitally signed by a developer. That makes repository ownership especially important: a recognizable project name does not establish who uploaded the files.
"Emulation fans are a perfect target. They are used to downloading experimental software from GitHub and running unsigned files, so nothing about this feels suspicious," said NordVPN CTO Marijus Briedis.
The malware first adds exclusion rules to Microsoft Defender, instructing the antivirus software to skip designated files or locations during scans. Rather than immediately launching its main payload, it changes security settings that could otherwise help detect the threat.
It then deploys an executable that NordVPN believes is an infostealer. Researchers suspect the program collects passwords and other sensitive information, although its full capabilities remain unclear. This classification is an assessment, not confirmation of everything the executable can do.
The cleanup script runs afterward, deleting the malware's own files and making it harder to trace the infection. This final step helps conceal evidence of the attack after the suspected infostealer has been deployed, potentially leaving the user with little indication of what happened.
The findings do not establish how many people downloaded the malicious packages or how many computers were compromised. Researchers have also not identified the suspected infostealer by name.
The recommended precaution is to verify that a repository is affiliated with the emulator's development team before downloading its files. Users should check the software's source rather than relying solely on a familiar project name or a page that looks legitimate.
Recently created lookalike repositories and listings with few reviews warrant closer inspection. These details can prompt further checks, but the key question is whether the developers themselves direct users to that repository.
Antivirus protection should remain enabled during downloads and installation. Users should not disable it simply because software is experimental or unsigned.
Ultimately, these malicious repositories exploit the gap between recognizing a project and verifying its download source. Confirming that connection before running a file is the most important safeguard against this type of impersonation.