Fake PS5 Emulators Are Sneaking Password Stealers Past Your Antivirus

You’re looking for a way to play your favorite PS5 games on your PC and stumble across what appears to be a legitimate PS5 emulator on GitHub. You download the file, open it, and everything seems perfectly normal.

But within minutes, the hidden malware has already told Microsoft Defender to ignore it, deployed a suspected information stealer, and deleted its own files without leaving an obvious trace. Your passwords and other sensitive data could already be compromised, and you’d have no idea.

Researchers have found two fake PS5 emulators imitating their legitimate counterparts. Anyone downloading them could end up with an information stealer that scoops up their passwords and other personal data.^[1]

Here’s what researchers found and how you can avoid falling victim to these fake emulators.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

What can the fake PS5 emulators do

According to Tom’s Hardware, citing a NordVPN Threat Intelligence report, PS5 emulators are being copied by malicious threat actors.

The first is AnyPS5, a portability layer that converts PS5 games so they can run as native applications on Linux and Windows. The other is Kyttyps5, an emulator that runs PS5 games on PC. Both projects are free and legitimately hosted on GitHub, which is why their fake versions seem convincing.

Users usually land on a fake repository that mimics the real project’s page and download a ZIP file containing a Windows executable. The executable unpacks a hidden application and starts a multi-stage loader.

The loader first checks whether it’s running on a real gamer's PC or in a security research sandbox by verifying four criteria:

• The PC has less than 2 GB of available RAM
• It’s running on a virtual machine
• It’s hosted on a cloud-based server
• There’s no physical GPU

If any of these conditions are met, the loader exits quietly, and the process stops there.

However, once the loader confirms that it’s running on a legitimate victim’s machine, it first adds exclusion rules to Microsoft Defender so that its files are not scanned by the antivirus. After this, the main payload is decrypted and executed. This is an executable wrapped in a commercial packer.

NordVPN researchers believe this payload to be an information stealer that can scoop up gamers’ sensitive data and passwords. Two minutes after the infection, a cleanup script runs, deleting the malware’s files and leaving no obvious trace.

Researchers say that the malware is signed with a self-signed certificate that uses made-up company names. The certificates were created on the same day as the malware, which may point to an automated operation. Also, the fake repositories are replaced quickly, and GitHub may not be the only place where they are hosted.

Emulators seem to be the perfect target for malicious cyber threat actors since people who use them are used to downloading unfinished software from GitHub and running files without developer signatures. So, the warning signs don’t look unusual to them.

Plus, interest in PS5 emulators could grow rapidly as the launch of GTA 6 on November 19 draws closer. That’s because GTA 6 is a console exclusive at launch, with a PC version not expected until early 2027, giving PC players enough reason to look for PS5 emulators. We’ve also got GTA 6 phishing scams trying to steal users’ passwords.

How to protect yourself from fake PS5 emulators

Here are some steps you can take to ensure you don’t end up downloading a fake PS5 emulator:

1. Check before downloading: Before downloading any files from a GitHub repository, check that the repository belongs to the official project team by looking at the owner’s name. If you see that the project and its files were created recently with little activity, this should be a big red flag. Also, be suspicious of any download links that lead you to third-party websites.
2. Use a third-party antivirus program: A reliable antivirus program can scan downloaded files for known malware before you run them. Many also offer real-time protection that can detect suspicious files and block malicious activity. Keep your antivirus updated and make sure its protection features are enabled.
3. Disconnect from the internet: If you believe that you have been infected, disconnect your PC from the internet immediately. This can stop the stealer from sending your information to the threat actors. After this, run a full antivirus scan.
4. Change your passwords: Consider changing your passwords from a different PC, as the one you used to download the files may still be infected. Use strong, unique passwords for each of your critical accounts. A reliable password manager can help you generate and remember these passwords.
5. Sign out of all sessions and use 2FA: If you suspect that your browser sessions or account credentials have been compromised, changing your passwords alone may not be enough to secure your accounts. Log out of all active sessions and enable two-factor authentication wherever available.
6. Use an identity theft protection service: If you have already downloaded a malicious emulator, your passwords and personally identifiable information could be in the hands of hackers. Consider getting an identity theft protection tool that can look for your leaked information in known breach databases and on the dark web.

The bottom line

Downloading either of the two fake PS5 emulators from GitHub could compromise your passwords and other sensitive data without leaving an obvious trace. The suspected information stealer is clever enough to detect whether it’s running on a real PC or in a sandboxed environment, and it deletes its files after executing its payload.

Make sure you download files only from legitimate GitHub repositories by checking the owner’s name. If you’ve already been infected, disconnect from the internet, change your passwords from a separate device, revoke all active sessions, and use reliable security tools like an antivirus and an identity theft protection service.

Protect Every Aspect of Your Digital Life — Even Your Time

4.7

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Claim Deal

On TotalAV's website

2026 Editors’ Choice

Best Antivirus for Safe Browsing

Antivirus Software

TotalAV

BLACK FRIDAY: Save $80 Off Today

• Antivirus that earned AV-TEST's Top Product award on Windows in August 2026
• Passed every malware and drive-by download test we ran, quarantining threats automatically
• Includes a junk cleaner, app uninstaller, and browser cleaner to keep your device running smoothly alongside the antivirus

Author Details

Krishi Chowdhary

About the Author

Krishi Chowdhary specializes in digital privacy, cybersecurity, and consumer technology. He has written extensively on online privacy tools and broader cybersecurity topics, including online scams, data breaches, age verification, and emerging digital threats. Krishi believes technology reporting should empower readers, not confuse them, and is committed to making even the most technical subjects easy to understand without compromising on accuracy or depth. His work has appeared in leading technology publications, including CNET, ExpressVPN, and TechRadar, where he has covered topics ranging from cybersecurity incidents and privacy product announcements to artificial intelligence and major technology news