Fake PS5 emulators are being used to steal gamers' passwords — two well-known GitHub repos, including popular AnyPS5, get hit, infecting gamers' computers with password-scraping malware

Malicious GitHub repositories have been found to distribute malware that targets gamers seeking to emulate PS5 games. The malware, disguised as legitimate tools, employs self-signed certificates and seemingly automated creation. Upon infection, the malware swiftly erases its presence, leaving no trace. The campaign exploits the popularity of two prominent PS5 emulation projects, AnyPS5 and Kyttyps5.

When users download the infected executables from the malicious repositories, they unknowingly install Windows malware. The malware employs various checks to determine if the infected machine is a legitimate target before executing its malicious payload. This payload is an infostealer designed to extract passwords and other sensitive data.

To avoid falling victim to this attack, gamers must verify the authenticity of the GitHub repositories hosting the emulation tools. Disconnecting the computer from the internet and running a full antivirus scan upon discovering a suspected infection is recommended. As the anticipation for GTA 6's release looms, PS5 emulation is expected to surge in popularity.