GoKawiilMalware disguised as PS5 emulators AnyPS5 and Kyttyps5 steals passwords via fake GitHub repos
NordVPN's Threat Intelligence team found malicious GitHub repositories impersonating the popular PS5 emulation tools AnyPS5 and Kyttyps5, tricking users into downloading a zip file with a Windows executable that steals passwords. The malware checks for signs of a sandbox or virtual machine before activating, adds exclusion rules to Microsoft Defender to avoid detection, and runs a cleanup script two minutes after infection to erase its traces.
GoKawiil's interpretation of the reporting above, not reported fact.
The use of self-signed certificates generated the same day as the malware suggests, according to NordVPN researchers, that the campaign could be automated and easily scaled or repeated. The rapid rotation of GitHub repositories indicates attackers may be adapting quickly to takedowns, which could make this type of threat harder for platforms and antivirus tools to contain going forward.
- Fake GitHub repos impersonated AnyPS5 and Kyttyps5 to spread password-stealing malware.
- The malware evades detection by checking for sandboxes, low RAM, or missing GPUs, and disables Microsoft Defender scanning.
- A cleanup script erases infection traces within two minutes, and the campaign's GitHub repos rotate rapidly.
NordVPN Threat Protection Pro — Since this malware campaign specifically targets gamers through fake emulator downloads to steal passwords, having robust protection against malicious downloads and phishing sites is essential. NordVPN's security suite, including threat protection features that block malware-laden files before they execute, is directly relevant to the exact threat described in this article. It's a practical safeguard for anyone browsing GitHub repos or downloading third-party gaming tools.
See NordVPN Threat Protection Pro on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: tomshardware.com — Oliver Haslam, 2026-10-29
Published there as: “Fake PS5 emulators are being used to steal gamers' passwords — two well-known GitHub repos, including popular AnyPS5, get hit, infecting gamers' computers with password-scraping malware”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.