Github Repositories

Malware disguised as PS5 emulators AnyPS5 and Kyttyps5 steals passwords via fake GitHub repos

NordVPN's Threat Intelligence team found malicious GitHub repositories impersonating the popular PS5 emulation tools AnyPS5 and Kyttyps5, tricking users into downloading a zip file with a Windows executable that steals passwords. The malware checks for signs of a sandbox or virtual machine before activating, adds exclusion rules to Microsoft Defender to avoid detection, and runs a cleanup script two minutes after infection to erase its traces.

tomshardware.com · 2026-10-29

CrowdSec discloses May breach of 170 private GitHub repos via ex-employee's stolen OAuth token

French security firm CrowdSec disclosed that attackers used the Shai-Hulud worm to compromise a former employee's machine in May, stealing a GitHub OAuth token that still had read access to the company's private repositories. Over roughly nine minutes, attackers downloaded about 170 private repos plus 130+ public ones; CrowdSec only learned of the breach on September 16 after stolen source code surfaced on the cybercrime marketplace pwnforum.

darkreading.com · 2026-09-22