Emulators downloaded via GitHub may be stealing your passwords, with two well-known projects being exploited.
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works .
The campaign trades on the back of the popularity of two projects that have become popular within the PS5 emulation community. AnyPS5 is a portability layer that allows PS5 games to run as native applications on both Windows and Linux. Kyttyps5 is an emulator for running PS5 games on PCs , and both projects are freely available for download via their respective GitHub repositories. However, users who visit one of the malicious repositories posing as these tools are directed to download a zip file containing a Windows executable. Notably, the GitHub repositories used as part of the malware campaign rapidly rotate, and it's possible that GitHub is not the only source.
The malicious executable unpacks a hidden application before launching its own multi-stage loader. It first checks whether the PC is a legitimate machine or a security researcher's sandbox by checking if less than 2GB of RAM is available, if it's a virtual machine, if it's running on a cloud-based server, or if it doesn't have a physical GPU installed. If any of those criteria are met, the loader exits silently. If the machine is deemed to be a legitimate target, the malware adds exclusion rules to Microsoft Defender to ensure that it will never be scanned and identified during an antivirus scan. Finally, the payload is decrypted and executed.
That payload, we're told, is an executable protected by a commercial packer that is believed to be an infostealer — a type of malware whose job it is to steal passwords as well as any other sensitive data that it comes across.
While this appears to be a relatively new malware attack, there are some steps that you can take to avoid falling foul of it. If you're trying to download tools like AnyPS5 and Kyttyps5, it's vital to ensure that the repository belongs to the official project team. Double-check the owner of the project, look for download links that use third-party destinations, and check metadata like the project and files' creation dates.
Open-source AnyPS5 dumps emulation to run PlayStation 5 console games natively on PC
Nintendo takes down over 400 GitHub repositories hosting Switch emulators in a single day
PS3 emulator devs warn of fake Blu-ray drives on Newegg and AliExpress
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cyber-security/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cyber-security/fake-ps5-emulators-are-being-used-to-infect-gamers-computers-with-password-scraping-malware-two-well-known-github-repos-including-anyps5-hit#main
- https://www.tomshardware.com/membership
- Pioneers Across Europe Deploy NVIDIA Earth-2 Open Models to Power Real-World Weather and Climate Prediction
- Score a huge $1,250 saving on this Alienware gaming PC with an RTX 5070 Ti and 32GB DDR5 right now
- Taiwan working on autonomous drone swarms to counter China’s increasingly aggressive grey-zone military tactics
- Elon Musk's SpaceX buying out 418 homes near flagship AI data center, but only if they drop participation in lawsuit
- Intel's APX offers 'better performance' in Windows 11 according to new Insider setting
Informational only. No financial advice. Do your own research.