Fake PS5 Emulators on GitHub Are Stealing Passwords
NordVPN's Threat Intelligence team has found fake PS5 emulators on GitHub that carry malware designed to steal passwords and other personal data, according to Engadget, which published the report on 28 October 2026.
The malicious repositories posed as the Kyttyps5 and AnyPS5 emulators. An emulator is a program that lets one system run software written for another, and each fake presented itself as legitimate emulation software. It was the kind of tool someone would search for when trying to run PlayStation 5 software on a PC.
The malware drops an executable that is believed to be an infostealer, a program that collects saved passwords. Before that payload can run unimpeded, the malware adds exclusion rules to Microsoft Defender, so the files are not scanned by the antivirus software. When its work is done, it runs a cleanup script that deletes its own files, removing much of the on-disk evidence of what happened.
NordVPN CTO Marijus Briedis said emulation fans are a target because they are used to downloading experimental software from GitHub and running unsigned files. Unsigned files carry no verified digital signature, so nothing confirms who made them. That observation points to where the attack gets its leverage. The technique needs no zero-day, meaning an unknown flaw with no fix available, and no compromise of an operating system component. It needs a user who is already comfortable overriding the usual warnings on an unsigned program.
The broader context here is familiar to anyone who has followed software supply chains, the path code takes from its author to the person running it. Developer platforms carry an implicit credibility, and a repository that looks like a community project can be created in minutes. Emulation users sit at an awkward intersection: they routinely pull niche, unofficial tools from unofficial sources, and they often accept that some will need manual fixing to run. An attacker who understands that culture does not have to fool a security-conscious audience. The lure works because the victims' own habits already lower the barrier.
In my view, the Defender exclusion step deserves more attention than the infostealer itself. A password collector is a known quantity, and most endpoint tools, the security software installed on individual devices, are built to catch one. Changing the scanner's configuration first means the malware is not only stealing credentials but also reducing the chance that a later stage gets caught. The self-deleting cleanup script makes life harder for responders. Without the original files, investigators lean more on telemetry, process logs, and records of what the machine did, and many home users never keep that kind of data.
For anyone who has run one of these binaries, the practical steps are conventional but worth stating. Credentials stored in browsers and used on affected machines should be rotated, starting with accounts where password reuse is possible. The exclusion list in Microsoft Defender should be reviewed for entries the user did not create. Downloads from unvetted repositories should be treated as untrusted until verified, and unsigned executables should not be run with elevated privileges as a matter of routine.
Emulation has real value. Preservation projects, homebrew development, and research into console architecture all depend on a community willing to experiment with software that is not yet polished or officially supported. The more that community learns to check where code comes from before running it, the less these campaigns have to work with, and the more the tools it relies on stay usable.
