Overview
- NordVPN’s Threat Intelligence team disclosed Thursday that malicious GitHub repositories impersonating two popular projects were distributing Windows binaries that put users at risk.
- The fake pages used the names AnyPS5 and Kyttyps5 to lure emulation users into downloading a ZIP with an executable instead of the real emulator code.
- Analysis shows the executable adds exclusion rules to Microsoft Defender, appears to deploy a suspected infostealer to harvest passwords and sensitive data, and runs a cleanup script that removes its files minutes later.
- The operation used short‑lived self‑signed certificates with bogus company names and rapidly rotating repositories, behavior that points to automated, ongoing distribution beyond a single repository.
- Researchers and outlets recommend avoiding unsigned or unfamiliar builds, verifying repository ownership before downloading, keeping antivirus enabled, and using layered threat monitoring because the full payload details and wider spread remain unconfirmed.