{
  "id": 17108696,
  "title": "Gamers hunting for PS5 emulators are actually downloading malware instead",
  "url": "https://urgent.news/2026/10/29/gamers-hunting-for-ps5-emulators-are-actually-downloading-malware",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-29T19:10:00.000Z",
  "source": {
    "name": "TechSpot",
    "slug": "techspot",
    "url": "https://www.techspot.com/news/114376-gamers-hunting-ps5-emulators-actually-downloading-malware-instead.html"
  },
  "original_language": "en",
  "account": "Recent activities on GitHub have revealed that users seeking unofficial PlayStation 5 emulators are inadvertently downloading malware instead. This deceptive scheme involves repositories masquerading as legitimate emulation projects, such as KyttyPS5 and AnyPS5. These malicious files deceive users by altering Microsoft Defender settings to exclude the malware's own files, making the intrusion more difficult to detect. The infection process begins with the malware adding exclusion rules to the antivirus software, allowing it to evade detection. Following this, an executable believed to be an information-stealing program is deployed, potentially collecting sensitive data like passwords. The cleanup script that follows deletes the malware's own files, further erasing evidence of the attack. This tactic capitalizes on the trusting nature of gamers who are accustomed to downloading experimental software from GitHub and running unsigned files. The threat intelligence team at NordVPN identified these malicious repositories, warning users to verify the trustworthiness of the repository and its developers before downloading any software. Emulation enthusiasts are particularly vulnerable to such attacks because they are accustomed to downloading and running unsigned files from GitHub. Users are advised to exercise caution and ensure that the repository is officially associated with the emulator's development team before proceeding with the download.",
  "summary": "A cleanup script deletes the malware's own files, making the intrusion harder for the PC's owner to detect. NordVPN's Threat Intelligence team discovered malicious repositories posing as the KyttyPS5 and AnyPS5 emulators. Their pages mimic legitimate emulation projects, giving users the impression that they are downloading gaming software. NordVPN warns... Read Entire Article",
  "key_points": [
    "Malware disguised as PS5 emulators downloaded by users",
    "Malware alters Microsoft Defender settings to hide itself",
    "Information-stealing program collects sensitive data"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}