Malicious actors are distributing malware disguised as popular PlayStation 5 emulators. The campaign targets users interested in projects such as AnyPS5 and Kyttyps5, which are typically hosted on GitHub. Victims are prompted to download a ZIP file containing a Windows executable from repositories that mimic legitimate project pages.
The malware employs a multi-stage loader to verify the target environment. It checks for specific hardware configurations, such as the presence of a physical GPU and at least 2GB of RAM. If the system is identified as a virtual machine or a sandbox used by security researchers, the loader terminates. Otherwise, it adds exclusion rules to Microsoft Defender to avoid detection.
Once the system is compromised, the malware executes a payload protected by a commercial packer. This payload functions as an infostealer designed to harvest passwords and sensitive user data. Security experts advise users to verify the official ownership of GitHub repositories and check file metadata before downloading any software.
In the event of a suspected infection, users are instructed to disconnect their devices from the internet immediately and perform a full antivirus scan. It is also recommended to change passwords using a separate, secure device. The interest in PS5 emulation is expected to grow ahead of the release of GTA 6, scheduled for November 19, 2026.
