PSA: Fake KytyPS5 and AnyPS5 Repos on GitHub Are Spreading Malware

Fake GitHub repositories posing as two PS5 projects, the KytyPS5 emulator and the AnyPS5 porting tool, are being used to spread password-stealing malware, according to NordVPN's Threat Intelligence team. As reported by Tom's Hardware, visitors get pointed to a ZIP file whose Windows executable unpacks a hidden multi-stage loader. The loader first checks whether it's on a real gaming PC, and exits if the system has less than 2 GB of RAM or no physical GPU, or looks like a virtual machine or cloud server. It seems built to dodge sandboxes and security researchers. Here's how NordVPN CTO Marijus Briedis put it:

Emulation fans are a perfect target. They are used to downloading experimental software from GitHub and running unsigned files, so nothing about this feels suspicious. But this is not an emulator. It steals your data, hides from your antivirus and erases its own tracks before you notice anything is wrong.

Read full story