Fake PS5 emulators on GitHub are stealing user passwords

The fake repositories imitated KytyPS5 and AnyPS5 at the time of NordVPN's investigation. 1

The malware excludes itself from Microsoft Defender and then deletes its own files. 1 5

Beware of recent clones with few reviews and never disable your antivirus. 1 6

AI-generated content reviewed by the editorial team. How we work

Synthesis of 7 sources · 2 background articles ✓ Official source Background from our archive

Shared origin: All sources relay NordVPN's investigation.

Original document: NordVPN Threat Intelligence

Oct 13, 2026 Jailbroken PS5 now runs physical PS3 discs via a rapid emulator
Oct 22, 2026 A PS5 exploit too dangerous to release may have just been patched
Oct 29, 2026 Fake PS5 emulators on GitHub are stealing user passwords

Image: KytyPS5 — https://github.com/KytyPS5/KytyPS5

Anyone searching GitHub for a PS5 emulator risks downloading a program that steals passwords and other personal data. NordVPN's threat intelligence team found malicious repositories disguised as existing emulators.

At the time of the investigation, the fake projects posed as KytyPS5 and AnyPS5, two known names in the emulation scene. The pages mirrored the look of the original software, so users would believe they were getting the real thing.

official image of Fake PS5 emulators on GitHub

Image: KytyPS5 — https://github.com/KytyPS5/kytyps5.github.io

NordVPN's CTO, Marijus Briedis, explains why the trick works on this audience: emulation fans are used to downloading experimental software from GitHub and running unsigned files, so nothing looks out of place. "It is not an emulator," he warns. "It steals your data, hides from your antivirus and erases its own tracks before you notice."

How the malware operates

Once downloaded, it adds exclusion rules to Microsoft Defender so the antivirus never scans it. It then installs an executable that, according to NordVPN, collects passwords and any other useful data on the machine. Finally, it runs a cleanup script that deletes its own files, leaving the PC owner none the wiser.

How to protect yourself

First, confirm the download link really belongs to the team behind the emulator. Be wary of clones with recent creation dates and few reviews. Above all, do not disable antivirus during download and installation.

AlexTech has already covered this scene, when the KyTyPS5 emulator started running GTA 5 at 60 FPS, drawing attention that scammers have evidently exploited. The official project is on GitHub, where the KytyPS5 site is documented as free and open-source software.

How the malware operates

How to protect yourself

Related Articles