PPE: Fake PlayStation 5 emulators hosted on GitHub spread malware that modifies Microsoft Defender settings before launching a suspected data theft program. The campaign exploits players’ willingness to experiment with unofficial software, making malicious downloads seem like a normal part of the process. It shows how well-known project names can gain users’ trust before they verify who is behind the files.
A cleanup script deletes the malware’s own files, making the intrusion harder for the PC owner to detect. NordVPN’s Threat Intelligence team has discovered malicious repositories masquerading as KyttyPS5 and AnyPS5 emulators. Their pages mimic legitimate emulation projects and give users the impression that they are downloading gaming software. NordVPN warns that the downloads instead put passwords and other personal information at risk.
The disguise is aimed at an audience used to experimenting with unfinished software. Users looking for experimental emulators can expect to download builds from GitHub and run files that have not been digitally signed by a developer. This is why ownership of the repository is particularly important: a recognizable project name does not say who uploaded the files.
“Emulation fans are a perfect target. They are used to downloading experimental software from GitHub and running unsigned files, so nothing about this seems suspicious,” said Marijus Briedis, CTO of NordVPN.
The malware first adds exclusion rules to Microsoft Defender and instructs the antivirus software to skip certain files or locations during scans. Instead of immediately launching its main payload, it modifies security settings that could otherwise help detect the threat.
It then deploys an executable that NordVPN believes is an infostealer. Researchers suspect that the program collects passwords and other sensitive information, although its full capabilities are still unclear. This classification is an evaluation and not an endorsement of all the features of the executable.
It then runs the cleanup script, which deletes the malware’s own files and makes it harder to trace the infection. This final step helps hide evidence of the attack after the suspected infostealer is deployed, so the user may have little clue as to what happened.
The results do not indicate how many people downloaded the malicious packages or how many computers were compromised. The researchers also did not identify the suspected infostealer by name.
The recommended precaution is to check if a repository is affiliated with the emulator’s development team before downloading its files. Users should check the source of the software instead of relying solely on a familiar project name or a page that looks legitimate.
Recently created lookalike repositories and listings with few reviews require closer inspection. These details may lead to further review, but the key question is whether the developers themselves are directing users to this repository.
Antivirus protection should remain enabled during downloads and installation. Users should not disable it just because the software is experimental or unsigned.
Ultimately, these malicious repositories exploit the gap between detecting a project and verifying its download source. Confirming this connection before executing a file is the most important protection against this type of identity theft.
