Overview
- NordVPN’s Threat Intelligence team, which reported the campaign on Oct. 29, found malicious GitHub pages posing as the KyttyPS5 and AnyPS5 emulator projects that lead users to download a Windows executable.
- The downloaded program adds exclusion rules to Microsoft Defender so the antivirus will skip specified files or folders and then appears to deploy a suspected infostealer that can harvest passwords and other sensitive data.
- A cleanup script runs minutes after infection to delete the malware’s files, leaving little forensic evidence and complicating efforts to measure how many users were compromised.
- Researchers observed rapidly rotating repositories and same‑day self‑signed certificates, signs that the attackers may be automating distribution and that GitHub might not be the only delivery channel.
- Security guidance for users includes verifying a repository is owned by the emulator developers, keeping antivirus enabled during installs, checking Windows Defender exclusions you did not set, and changing passwords from a clean device if you ran an unknown build.