Fake PS5 emulators on GitHub spread password-stealing malware

NordVPN's threat research team found malicious GitHub repositories posing as the Kyttyps5 and AnyPS5 PS5 emulators. The malware adds Microsoft Defender exclusions, deploys an infostealer for passwords and personal data, then deletes its own files to cover its tracks.

• Malware adds Microsoft Defender exclusions so it is never scanned
• A cleanup script deletes its files after data theft
• Fake repos impersonate Kyttyps5 and AnyPS5 emulators
• NordVPN advises verifying the GitHub repo belongs to the project team