Lookalike GitHub repositories impersonating PS5 projects were used to spread Windows malware, NordVPN research says
Research attributed to NordVPN’s Threat Intelligence team describes a malware campaign that used GitHub repositories made to resemble the AnyPS5 and KytyPS5 projects. TechSpot and PCMag UK reported the findings on 28 October 2026, Hardware Upgrade added technical detail the next day and eSecurity Planet published a summary on 30 October. None of the reports describes a breach of GitHub, Sony or the official projects.
The lure depended on a familiar name rather than a convincing piece of software. According to PCMag, the fake pages offered a ZIP file containing Windows malware and mimicked projects that had attracted interest from people wanting to play PlayStation 5 games on a PC. Visitors who recognised the project name could still miss the more important question: who controlled the repository serving the download.
PCMag noted that AnyPS5 is technically a portability layer that runs PS5 games natively on Windows and Linux, not an emulator. KytyPS5 is described as a PC emulator. That distinction matters because broad emulator headlines can obscure the fact that this was impersonation of those projects. Windows Forum likewise found no indication in the reporting it examined that the real AnyPS5 or KytyPS5 projects, or their developers’ accounts, had been hacked. eSecurity Planet described lookalike repositories as a route that did not necessarily compromise the original developers.
What the reports say happened
The chain described by PCMag and Hardware Upgrade, both relaying NordVPN, began with a downloaded ZIP archive. The executable inside unpacked a hidden application and started a multi-stage loader. That loader exited silently if it found less than 2GB of RAM, a virtual machine, a cloud server or no physical graphics card. Those conditions can be common in analysis environments. A gaming PC with enough memory and a physical graphics card would not normally match them.
If the checks passed, the loader added Microsoft Defender exclusions so scans would skip the folders where it operated. It then deployed a packed executable that NordVPN believed was an infostealer. Hardware Upgrade reported that a cleanup script deleted the malware’s files about two minutes after infection. The combination of environment checks, defence exclusions and rapid cleanup is consistent with malware designed to avoid casual inspection and resist analysis. It does not, on its own, show how many people ran it or what data, if any, left their machines.
The reporting also described signs that the files were generated in an automated way. PCMag said NordVPN examined two samples built a day apart starting on 10 October. Hardware Upgrade reported that they were signed with self-signed certificates bearing invented company names, issued on the same day as compilation, which NordVPN said suggested automated generation. The available reports do not state the year of the October build dates, so they should not be read as confirmed 2026 events.
The evidence has a single origin
The central limit is not the technical plausibility of the chain. It is the source base. The reports trace to the same NordVPN investigation. Windows Forum noted that the coverage it reviewed all reported that research and that no public NordVPN technical write-up had surfaced. Multiple headlines therefore do not amount to multiple independent investigations. The absence of a public write-up in the reports reviewed is not proof that none exists elsewhere, but it is a reason to keep the language precise.
That precision matters most around the payload and its impact. TechSpot and Hardware Upgrade reported that NordVPN believed the executable was an infostealer but had not confirmed its full capabilities. Windows Forum noted that no malware family was named. TechSpot also reported that the findings did not establish how many people downloaded the packages or how many computers were compromised. PCMag relayed an unnamed Reddit user’s account of receiving emails about three accounts being hacked after running a fake AnyPS5 installer, but that is an unverified individual report, not confirmation of theft from any specific victim.
The same caution applies to the campaign’s status. PCMag reported that the bogus GitHub pages for AnyPS5 and KytyPS5 had been removed. That is a point-in-time action, not evidence that the operation ended. NordVPN warned, as relayed by PCMag, that the repositories were rotating rapidly and that the activity could extend to other code-hosting sites. The warning is an attributed assessment, not platform telemetry, but it makes removal of two named pages a weak basis for reassurance.
Checks that fit the documented risk
The useful defence is to verify provenance before running a file. For projects such as these, that means starting from a developer’s established channel and following its link to a repository, rather than searching for a project name and trusting the first plausible result. Repository ownership, release history and creation date are more informative than visual similarity. Recently created lookalikes, sparse history, few reviews and download links that lead away from the project’s own channels are reasons to stop. GitHub hosting is not a security guarantee, and neither is a recognisable project name.
Antivirus protection should stay on during downloads and installation, including for experimental or unsigned software. A file that will only work if it is excluded from Defender scans, or a page that asks the user to disable protection, is not making a normal request. If someone has already run a dubious installer, the precautionary advice relayed in the coverage is to disconnect the computer from the internet, run a full antivirus scan, review unexpected Defender exclusions and change passwords from another device. Those steps were not tested against this campaign, so they should be treated as containment and hygiene measures rather than a guaranteed cleanup.
What remains unresolved is concrete: the number of repositories, the number of downloads, the number of infected machines, whether data was taken and what the suspected payload can do beyond the assessment. Until independent telemetry or a technical report addresses those points, the evidence describes a distribution tactic rather than a measured incident. The practical test is whether the project’s own maintainers stand behind the file being offered, not whether its name looks right.
A download page can look exactly like the project it imitates, so the question that actually protects you is quieter: who owns the repository, when was it created, and does the maintainer’s own channel point to it? Checking provenance before running a file is a small, repeatable habit that sits inside cybersecurity fundamentals, where software, access and evidence are assessed rather than assumed, and a familiar project name counts for nothing on its own. The same grounding helps when reading reports like this one, keeping a suspected payload separate from a measured infection. That habit is worth practising deliberately, and The Hack Academy’s online cybersecurity training programme covers cybersecurity fundamentals through self-paced learning and practical exercises alongside the theory.