Fake PS5 Emulators on GitHub Are Stealing Passwords: How the Scam Works and How to Stay Safe
By MetaPatchAI News Team · Edited by MetaPatchAI Staff · Based on NordVPN Threat Intelligence findings as reported by Oliver Haslam at Tom's Hardware (Oct. 29, 2026), plus Engadget, TechPowerUp and PCMag
Published Oct. 31, 2026 · MetaPatchAI Safety Explainer · This article contains no download links, on purpose.
If you've searched for a "PS5 emulator for PC" this week, be careful. Security researchers at NordVPN's Threat Intelligence team say fake GitHub repositories posing as PS5 emulation projects are spreading Windows password-stealing malware. The warning has been reported by Oliver Haslam at Tom's Hardware, Engadget, TechPowerUp and PCMag.
First: there's no finished PS5 emulator you can download
There is no finished, general-purpose PS5 emulator that plays the PS5 library on PC. Any site or repo offering a "PS5 emulator, just download and play" should be treated as bait. The fake repos copy the names of two real experimental projects: KytyPS5, an emulator, and AnyPS5, a porting tool. PCMag points out that AnyPS5 "technically isn't an emulator" because it ports games rather than emulating the console. Both real projects are experimental, and it's the hype around them that scammers are using. NordVPN CTO Marijus Briedis put it this way, as quoted by TechPowerUp and IGN: "This is not an emulator. It steals your data, hides from your antivirus and erases its own tracks before you notice anything is wrong."
How the attack works (per NordVPN, as reported)
- Look-alike repos. Fake GitHub pages copy the real projects. The pages rotate quickly, so taking down one link doesn't stop the campaign.
- A ZIP with a Windows executable. Visitors are told to download an archive. The program inside unpacks a hidden, multi-stage loader.
- Checks for a real gaming PC. The loader quits silently if the machine has less than 2 GB of RAM, looks like a virtual machine or cloud server, or has no physical GPU. These are common ways to avoid security researchers' test machines.
- Turns off antivirus scanning for itself. On a real PC, it adds Microsoft Defender exclusion rules so its files aren't scanned.
- Steals data. It then decrypts and runs a packed payload that researchers believe is an infostealer, malware that collects passwords and other sensitive data.
- Deletes its tracks. About two minutes later, a cleanup script removes the files.
Researchers also found self-signed certificates with fake company names, created the same day as the malware. They say this suggests the campaign is automated. PCMag reports that the fake pages it covered were removed, but the rotation means new ones can appear.
Why gamers are the target
Briedis explains the reasoning: "Emulation fans are a perfect target. They are used to downloading experimental software from GitHub and running unsigned files, so nothing about this feels suspicious." TechPowerUp notes that the same Defender-exclusion trick showed up earlier in a fake "leaked" GTA 6 build.
How to protect yourself
- Be suspicious of anything promising "PS5 games on PC, ready to play."
- Check who owns a repository before you download anything. Look at the account name, when it was created, the commit history and the release dates. Watch out for brand-new lookalikes with few stars or little history.
- Avoid third-party download links and ZIPs hosted outside the project's own releases.
- Never disable your antivirus or add Defender exclusions because an installer or README tells you to.
- Don't treat a virtual machine as a safety test. This loader quits silently inside VMs, so a "clean" run in a VM proves nothing. If you do test experimental software, use a spare machine with no saved logins.
If you already ran one
Following the researchers' advice reported by Tom's Hardware and TechPowerUp: 1. Disconnect the PC from the internet. 2. Run a full antivirus scan. Also open Windows Security and check for exclusions you didn't add. 3. Change your passwords from a different device, starting with email, Steam, PlayStation, Discord and banking. Turn on two-factor authentication. 4. Sign out of active sessions on important accounts. Infostealers often grab browser session cookies too.
What's confirmed / not confirmed
Confirmed (NordVPN research as reported by Tom's Hardware, Engadget, TechPowerUp and PCMag): - Fake GitHub repos impersonate KytyPS5 and AnyPS5 and deliver Windows malware in ZIP files. - The malware avoids virtual machines and sandboxes, adds Defender exclusions, runs a suspected infostealer and deletes itself after about two minutes. - The repos rotate. The certificates carry fake company names.
Not confirmed: - The exact malware family. NordVPN says it "believes" the payload is an infostealer. - How many people were infected. No number has been published. - Whether the campaign has spread beyond GitHub. Tom's Hardware says it's "possible."
We found no public NordVPN write-up. Tom's Hardware says the report was shared with it directly, so the details above come from the outlets that received or reported NordVPN's findings.
Related
Up: Gaming