Gaming enthusiasts looking for “fake” PS5 emulators on GitHub may be downloading malware, according to the threat‑research division of NordVPN. The company’s Threat Intelligence team discovered that the malicious code is masquerading as legitimate emulation tools and is designed to capture passwords and other personal information. The repository pages copy the appearance of real emulators, making it easy for users to believe they are obtaining authentic software.
At the time of writing, the harmful repositories were posing as the well‑known Kyttyps5 and AnyPS5 emulators. “Emulation fans are a perfect target. They are used to downloading experimental software from GitHub and running unsigned files, so nothing about this feels suspicious,” said NordVPN CTO Marijus Briedis. “But this is not an emulator. It steals your data, hides from your antivirus and erases its own tracks before you notice anything is wrong.”
The infection process works in several steps. After a user runs the downloaded file, the program creates exclusion rules for Microsoft Defender, preventing future scans. It then drops an executable that NordVPN identifies as an infostealer, harvesting passwords and any other accessible data. Finally, a cleanup script removes the malware’s own files, leaving little evidence of its presence.
To stay safe, verify that any GitHub link you use is linked to the official project team behind the emulator. Be cautious of repositories with recent creation dates and few reviews, and keep your antivirus software enabled throughout the download and installation process.
Sony announced earlier this year that it would stop officially porting its first‑party titles to PC, a move that may be driving interest in unofficial emulators such as Kyttyps5.