Security researchers have identified multiple fake GitHub repositories that pose as utilities for launching PlayStation 5 games on Windows PCs. Instead of enabling gameplay, these repositories deliver a multi-stage infection chain that disables parts of antivirus protection and deploys malicious payloads.
The campaign, detailed by NordVPN to Tom’s Hardware, centers on two repository names: AnyPS5 and Kyttyps5. Visitors are prompted to download a ZIP archive containing a Windows executable. After launch, the initial loader performs environment checks including memory volume, signs of virtual machines or cloud servers, and the presence of a physical graphics card. Suspicious environments cause the program to terminate.
On suitable systems the loader adds exclusions to Microsoft Defender, decrypts, and executes the primary payload. Analysts assess that the payload functions as an infostealer designed to harvest passwords and other confidential information, although the exact malware family remains unidentified.
The infection chain also includes a script that deletes files roughly two minutes after execution. While this cleanup removes some components, it does not guarantee that the compromise will go undetected. Researchers advise verifying repository ownership and download provenance before running any such utilities. If a suspicious file has already executed, users should disconnect the device from the network, run a full antivirus scan, and change passwords from a separate device.
