Fake PS5 emulators are being used to steal gamers' passwords — two well-known GitHub repos, including popular AnyPS5, get hit, infecting gamers' computers with password-scraping malware
Malicious GitHub repositories impersonating legitimate PS5 emulation tools are infecting gamers with password-scraping malware, according to NordVPN's Threat Intelligence team.
The malware uses self-signed certificates created with fake company names on the same day the malware was built, suggesting an automated campaign. Just two minutes after infection, a cleanup script removes all traces of the malware from affected computers.
Popular Projects Targeted
The campaign exploits the popularity of AnyPS5, a portability layer allowing PS5 games to run natively on Windows and Linux, and Kyttyps5, an emulator for running PS5 games on PCs. Both legitimate projects are freely available on GitHub.
The campaign trades on the back of the popularity of two projects that have become popular within the PS5 emulation community.
Infection Method
Users visiting malicious repositories posing as these tools are directed to download a zip file containing a Windows executable. The GitHub repositories used in the campaign rapidly rotate, suggesting GitHub may not be the only source of infection.
Related
