Fake GitHub PlayStation 5 Emulator Repositories Spread Information Stealing Malware

Cybersecurity researchers at NordVPN identified a malware campaign on GitHub that uses fake repositories to deliver information-stealing software. Gadget Review reported that the malicious repositories impersonated legitimate PlayStation 5 projects named KytyPS5 and AnyPS5. The deceptive pages targeted users searching for emulation tools and directed them to download malicious files. [1]

According to Gadget Review, the fake repositories instructed visitors to download ZIP archives. These archives contained Windows executable files rather than functional emulation software. The dropped infostealer malware is capable of bypassing Windows Defender within minutes of execution. [1]

Malware campaigns frequently target credential and system data. Ransomware and information stealers often seek private victim data or access credentials. As FTMQ Security reported earlier, attackers have also increasingly targeted OAuth access and refresh tokens to bypass multi-factor authentication and maintain access to corporate systems. [2][3]

Gadget Review advised users to verify source authenticity before downloading software from public repositories. Attackers relied on the trusted reputation of GitHub among developers and hobbyists to trick users into running the malicious binaries. [1]