Fake PS5 emulator downloads on GitHub deliver malware
NordVPN researchers say the malicious software changes Microsoft Defender settings and deploys a suspected password-stealing program.
Malicious GitHub repositories impersonating PlayStation 5 emulator projects are distributing software that weakens antivirus checks before deploying a suspected data-stealing program, according to NordVPN’s Threat Intelligence team. The repositories pose as KyttyPS5 and AnyPS5.
NordVPN said the malware creates exclusions in Microsoft Defender so that specified locations or files escape scanning. It then runs an executable that researchers believe could steal passwords and sensitive personal data. The program’s full capabilities have not been established.
After that executable is deployed, a cleanup script removes files belonging to the malware. The deletion makes evidence of the intrusion more difficult to find and can leave the computer’s owner with few signs of the attack.
NordVPN CTO Marijus Briedis said emulator enthusiasts are accustomed to trying experimental GitHub downloads and unsigned software, making the disguise less conspicuous. The findings give no download or compromised-computer counts, and researchers have not named the suspected data-stealing program.
