Fake PS5 emulator repos on GitHub spread password-stealing malware

Malicious GitHub repositories posing as two well-known PS5 emulation tools, AnyPS5 and Kyttyps5, are spreading malware that steals gamers’ passwords, according to a report from NordVPN’s Threat Intelligence research team that was shared with Tom’s Hardware. ¹

The real AnyPS5 is a portability layer that lets PS5 games run as native apps on Windows and Linux. Kyttyps5 is an emulator for running PS5 games on PCs. Both are free to download from their official GitHub pages. ¹

The fake repositories send visitors to a zip file holding a Windows executable. The repositories used in the campaign rotate quickly, and GitHub may not be the only place the files are hosted. ¹

How the malware works

Once launched, the executable unpacks a hidden application and starts a multi-stage loader. The loader first tries to work out whether it is running on a real gaming PC or in a researcher’s test environment. It quits silently if the machine has less than 2 GB of RAM available, is a virtual machine, runs on a cloud server, or has no physical GPU. ¹

If the machine passes those checks, the malware adds exclusion rules to Microsoft Defender, so the antivirus will not scan it. Then it decrypts and runs its final payload. ¹

That payload is an executable wrapped in a commercial packer, a tool that scrambles a program so it is harder to inspect. It is believed to be an infostealer, a type of malware built to grab passwords and other sensitive data it finds on the machine. ¹

Two details point to automation, the report says. The files are signed with self-signed certificates, which are certificates a developer issues to themselves rather than getting one from a trusted authority, and they carry fake company names. The certificates were created on the same day the malware was built. About two minutes after infection, a cleanup script removes the malware’s files from the computer, leaving no trace. ¹

What you should do

Before downloading any emulator, confirm the repository belongs to the official project team. Check who owns it, watch for download links that point to third-party sites, and look at the creation dates of the project and its files. ¹

If you may have run one of these downloads, disconnect the PC from the internet and run a full antivirus scan. Change your passwords from a separate device where possible. A password change costs a few minutes, and it matters most here because the goal of this malware is to take them. ¹

The timing may not be an accident. Tom’s Hardware notes that interest in PS5 emulation is likely to climb once GTA 6 launches on November 19, 2026 as a console exclusive, with a PC version expected in early 2027. ¹

This story rests on a single outlet relaying one research team’s report, and we have not seen the NordVPN report itself.

Our read: Emulator searches are a reliable place for lookalike downloads to hide, and the cleanup script means a scan after the fact may find nothing. That makes the check before you download the step that counts. Watch for GitHub removing the rotating repositories and for any fuller technical write-up from the researchers.

Footnotes

1. Tom’s Hardware, “Fake PS5 emulators are being used to steal gamers’ passwords — two well-known GitHub repos, including popular AnyPS5, get hit, infecting gamers’ computers with password-scraping malware”. Retrieved October 29, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰