Overview
- NordVPN’s Threat Intelligence team reported the campaign in late October after finding lookalike GitHub repos impersonating AnyPS5 and KytyPS5 that direct users to ZIPs with a Windows executable.
- The executable first adds exclusion rules to Microsoft Defender so the malicious files are skipped during scans, which helps the attack avoid detection.
- Researchers say the payload is likely an infostealer that harvests saved passwords and other sensitive data, though the specific malware family has not been publicly identified.
- A cleanup script runs minutes after infection to delete the malware’s files, and repositories appear to rotate rapidly, leaving attribution and the total number of victims unknown.
- Users should verify repository ownership before downloading, keep antivirus enabled, check Defender exclusions for unexpected entries, and change passwords from a clean device if they ran a suspect file.