NordVPN finds fake PS5 emulators with password stealers on GitHub — Engadget

NordVPN researchers have discovered fake PlayStation 5 emulators on GitHub that masquerade as legitimate software and can steal passwords and other personal data. Engadget reports, citing the VPN service's Threat Intelligence team.

Repositories imitate well-known projects

According to NordVPN, the pages of these repositories copy the design of existing emulation programs, which may cause users to mistakenly download a malicious file. At the time of the research, the malicious repositories were posing as the popular Kyttyps5 and AnyPS5 emulators.

NordVPN Chief Technology Officer Marijus Briedis noted that emulation enthusiasts often download experimental software from GitHub and run unsigned files, so this scheme may not raise suspicion.

More current news is available on the UA.News Telegram channel Telegram.

How the malware works

After being downloaded, the malicious program, according to the researchers' findings, adds exclusions to Microsoft Defender to avoid antivirus scanning. It then launches an executable file that NordVPN considers an infostealer — a program for collecting passwords and other available data.

At the final stage, the malware runs a cleanup script that deletes its files. NordVPN advises checking whether a GitHub link is associated with the emulator's development team, being wary of recently created repositories with few reviews, and not disabling antivirus software while downloading and installing programs.