Quick answer: NordVPN researchers found GitHub repositories impersonating the AnyPS5 and KytyPS5 projects that hand out Windows malware believed to steal passwords. It hides from Microsoft Defender and deletes its own files.
If you've been following PS5 emulation on PC, be careful where you download from. NordVPN's Threat Intelligence team found malicious GitHub repositories posing as AnyPS5 and KytyPS5, two open-source projects for running PS5 games on PC. Engadget and VideoCardz reported the findings this week.
The fake pages point people to ZIP files with Windows programs inside. According to the researchers, the malware first checks the system, looking at memory, virtualization and whether there's a physical GPU, and stops if it looks like an analysis setup, such as a machine with less than 2GB of RAM. On a real PC it adds exclusion rules to Microsoft Defender so it won't be scanned, then decrypts and runs a payload the researchers believe is an infostealer that collects passwords and other data. About two minutes later, a cleanup script deletes its files.
The researchers also found self-signed certificates under fake company names, created the same day as the malicious files, and the fake repositories keep changing, which makes the download links hard to track. NordVPN CTO Marijus Briedis told Engadget that emulation fans are "a perfect target" because they're used to running unsigned files from GitHub.
VideoCardz says the real AnyPS5 repository is run by boykopovar, and the real KytyPS5 repository belongs to the KytyPS5 organization. Engadget's advice is to make sure a GitHub page actually belongs to the project team, be wary of look-alikes with recent creation dates and few reviews, and never turn off your antivirus to install something.