Gamers hunting for PS5 emulators are actually downloading malware instead

Recent activities on GitHub have revealed that users seeking unofficial PlayStation 5 emulators are inadvertently downloading malware instead. This deceptive scheme involves repositories masquerading as legitimate emulation projects, such as KyttyPS5 and AnyPS5. These malicious files deceive users by altering Microsoft Defender settings to exclude the malware's own files, making the intrusion more difficult to detect.

The infection process begins with the malware adding exclusion rules to the antivirus software, allowing it to evade detection. Following this, an executable believed to be an information-stealing program is deployed, potentially collecting sensitive data like passwords. The cleanup script that follows deletes the malware's own files, further erasing evidence of the attack.

This tactic capitalizes on the trusting nature of gamers who are accustomed to downloading experimental software from GitHub and running unsigned files. The threat intelligence team at NordVPN identified these malicious repositories, warning users to verify the trustworthiness of the repository and its developers before downloading any software.

Emulation enthusiasts are particularly vulnerable to such attacks because they are accustomed to downloading and running unsigned files from GitHub. Users are advised to exercise caution and ensure that the repository is officially associated with the emulator's development team before proceeding with the download.