Fake PS5 Emulator Repositories Deliver Windows Malware

NordVPN’s Threat Intelligence team says malicious GitHub repositories posing as the KyttyPS5 and AnyPS5 projects are distributing Windows malware that changes Microsoft Defender settings and may steal passwords and other personal data. The malware’s full capabilities have not been confirmed. The repositories imitate legitimate software projects sought by people looking to run PlayStation 5 games on computers. NordVPN says the downloads are not the emulation tools they claim to be, but ZIP files containing Windows malware. The projects have GitHub pages, and the lookalike listings use familiar names that may make them appear trustworthy. According to NordVPN’s researchers, the malware first adds exclusion rules to Microsoft Defender, directing the antivirus program not to scan specified files or locations. It then launches an executable that the company believes may be an infostealer. That assessment suggests the program could collect passwords or other sensitive information, but the researchers have not established precisely what data it can access. The malware also deletes its own files, according to NordVPN. Its research indicates that the cleanup occurs after infection; a...