# Fake PS5 tool repositories spread suspected password-stealing malware

_Published Thursday, October 29, 2026 at 8:23 AM EDT · Security · Latest · Tier 2 — Notable_

![PS5 — Primary](https://cdn.mos.cms.futurecdn.net/hvR9HQGsb9khuSd3sSJxCY-2000-80.jpg)

Malicious GitHub repositories impersonating the PS5 tools AnyPS5 and Kyttyps5 distribute malware believed to steal passwords, NordVPN's Threat Intelligence team told Tom's Hardware. The repositories direct users to ZIP downloads containing a Windows executable and rotate rapidly.

The loader checks for virtual machines and other signs of security analysis before adding Microsoft Defender exclusions and executing its decrypted payload. A cleanup script deletes malware files two minutes after infection. Researchers believe the protected payload is an information stealer; its classification remains qualified.

## Sources

- [Tom's Hardware](https://www.tomshardware.com/tech-industry/cyber-security/fake-ps5-emulators-are-being-used-to-infect-gamers-computers-with-password-scraping-malware-two-well-known-github-repos-including-anyps5-hit)

---
Canonical: https://techandbusiness.org/newswire/Ffh_V2yO2qe81gMjz7JOox
Published: 2026-10-29T12:23:37.870Z
Story chronology: 2026-10-29T11:20:00.000Z
Retrieved: 2026-10-29T14:58:54.028Z
Publisher: Tech & Business (techandbusiness.org)