Malicious Repositories Target Gamers
Malicious GitHub repositories masquerading as two well-known and legitimate PS5 game emulation tools have been identified as spreading malware that steals gamers' passwords. The malware uses self-signed certificates, created using fake company names and on the same day the malware was built, suggesting that the malware campaign may be automated. Just two minutes after infection, a cleanup script scrubs the affected computer of the malware's files, leaving no trace that it was ever present.
The campaign trades on the popularity of projects within the PS5 emulation community. AnyPS5 is a portability layer that allows PS5 games to run as native applications on Windows and Linux, while Kyttyps5 is an emulator for running PS5 games on PCs. Both projects are freely available via their respective GitHub repositories. However, users who visit malicious repositories posing as these tools are directed to download a zip file containing a Windows executable. These GitHub repositories rapidly rotate.
Multi-Stage Loader and Evasion Tactics
The malicious executable unpacks a hidden application before launching a multi-stage loader. It first checks whether the PC is a legitimate machine or a security researcher's sandbox by checking if less than 2GB of RAM is available, if it is a virtual machine, if it runs on a cloud-based server, or if it lacks a physical GPU. If any criteria are met, the loader exits silently. If deemed a legitimate target, the malware adds exclusion rules to Microsoft Defender before decrypting and executing the payload.
The payload is an executable protected by a commercial packer functioning as an infostealer, designed to harvest passwords and other sensitive data.
Prevention and Remediation
Users downloading tools like AnyPS5 and Kyttyps5 should ensure repositories belong to official project teams. Verify the project owner, avoid third-party download links, and check metadata such as creation dates. If a suspected malicious file has been accessed, disconnect the computer from the internet and run a full antivirus scan while changing passwords from a separate device.
If you do find yourself in a position where you have accessed a suspected malicious download, disconnect your computer from the internet and run a full antivirus scan. It is also recommended that you change your passwords from a separate device where possible.
PS5 emulation interest continues to rise ahead of major releases expected over the coming years, making security vigilance increasingly critical for enthusiasts.
