If you’ve downloaded a PS5 emulator from GitHub, it’s worth double-checking what you installed. According to a report from Engadget, NordVPN’s Threat Intelligence team found fake GitHub projects posing as two PS5 emulators, KytyPS5 and AnyPS5. An emulator is software that lets a PC act like a game console.

Why does this matter? The fakes don’t run PS5 games at all. They appear to go after saved browser passwords and other personal data on Windows PCs. NordVPN believes the software is a type of malware called an infostealer, though the team isn’t certain of that.

The program also covers its tracks. It tells Microsoft Defender, the antivirus built into Windows, to skip scanning it. Then a cleanup script deletes the malware’s own files, so you may never notice anything happened. NordVPN’s chief technology officer, Marijus Briedis, put it this way: it “steals your data, hides from your antivirus and erases its own tracks.”

Why emulator fans are the target

The scheme works because emulator fans are used to this routine. Many download early, experimental software from GitHub, a website where programmers share their work. They also run files that haven’t been checked by a trusted publisher. Briedis says that makes them unlikely to suspect a scheme.

The fake pages are built to look like the real projects, so nothing looks wrong at first glance. This also isn’t the first case. Malwarebytes described a similar scheme in June, when a fake GitHub download aimed at PlayStation Vita owners delivered malware.

Reports so far don’t say how many fake pages exist or how many people downloaded them.

What to do now

Before you download anything, check that the GitHub page is tied to the emulator’s real developers. Be wary of brand-new pages with few reviews. Never turn off your antivirus to install something.

If you already ran one of these files, assume your passwords could be exposed. For a similar case, Malwarebytes advises running a full scan and changing your passwords from a clean device. It also suggests checking your accounts for logins you don’t recognize and reviewing your two-factor settings. Because this malware adds its own Defender exclusions, it’s also worth checking Windows Security for exclusions you didn’t set up.

When in doubt, stick to downloads linked from an emulator’s official site.

The post Gamers beware, fake PS5 emulators on GitHub may steal passwords appeared first on Phandroid.