Fake PS5 emulators on GitHub tell Defender to look away, then steal your passwords

There is no PS5 emulator you can download tonight and play the latest exclusives on. That gap between what people want and what actually exists is where this week's malware lives. NordVPN's threat intelligence team has found GitHub repositories dressed up as two real open-source projects, AnyPS5 and KytyPS5, that run nothing at all apart from a Windows password stealer.

The sequence NordVPN describes is tidy. Once launched, the program adds exclusion rules to Microsoft Defender so the antivirus skips its components. It then drops an executable the researchers believe is an infostealer, aimed at saved passwords and other personal data, and finishes with a cleanup script that deletes its own files. NordVPN's CTO Marijus Briedis put it bluntly: it "steals your data, hides from your antivirus and erases its own tracks." There's no victim count yet, and the fake repositories were rotating, so the same files may well surface outside GitHub.

Emulation fans make easy targets because they're used to running unsigned, experimental builds that Windows complains about. So check that a GitHub link really belongs to the project's own team, and be suspicious of brand new repositories with hardly any stars or history. Any installer that asks you to switch off antivirus, or quietly does it for you, has told you what it is. You can see what's been excluded under Windows Security, Virus & threat protection, Manage settings, then Add or remove exclusions; an entry you didn't add yourself is a red flag. If you've already run one of these, disconnect the PC, run a full scan, and change your passwords from a different device, starting with email.

Tendvane's Safety check for unwanted software is a sensible second look at what landed on a PC after a download like this, though it isn't an antivirus and won't replace that full scan.