NordVPN

Fake GitHub Repositories Mimicking PS5 Game Launchers Infect Windows PCs with Trojans

Researchers at NordVPN have uncovered a malware campaign using fake GitHub repositories that impersonate tools for running PlayStation 5 games on Windows computers. The repositories, named AnyPS5 and Kyttyps5, distribute ZIP archives containing executable files that initiate a multi-stage infection process. Upon execution, the loader checks system memory size, detects virtual machines or cloud servers, and verifies the presence of a physical GPU before proceeding. If the environment appears legitimate, it adds exclusions to Microsoft Defender and decrypts the main payload, believed to be an infostealer targeting passwords and sensitive data. A cleanup script also runs after approximately two minutes to delete components, though traces may remain detectable. NordVPN shared its findings with Tom’s Hardware, emphasizing the need to verify repository owners before running such tools.