PSA: Fake KytyPS5 and AnyPS5 Repos on GitHub Are Spreading Malware
Fake GitHub repositories posing as two PS5 projects, the KytyPS5 emulator and the AnyPS5 porting tool, are being used to spread password-stealing…
Why am I seeing this Single-sourced — only TechPowerUp has this
Only TechPowerUp has this. It is here on that single source, so read it as one outlet's reporting until somebody else confirms it.
Single-sourced. No second organisation has confirmed it yet.
Link-outLink-out, because only one organisation carries it and no first-party source is on it. Link-out means we point at the publisher and say nothing of our own.
| Factor | Weight | Score | Contribution | Where it came from |
|---|---|---|---|---|
| Corroborationleads | 0.35 | 0.39 | +0.135 40% | 1 independent org on the story. Tier-3 aggregators never corroborate — they can show something is circulating, never that it is true. |
| Source trust | 0.25 | 0.44 | +0.110 33% | TechPowerUp is the highest-trust source on this story. Trust is taken from the best source, not averaged. |
| Pickup rate | 0.20 | 0.00 | +0.000 0% | One counted organisation, so there is no spread to measure — nothing has picked this up to set a rate. |
| Freshness | 0.20 | 0.45 | +0.090 27% | Halves every 10 hours from the newest item on the story. This is the only factor that rewards a story for nothing more than being recent. |
Corroboration counts distinct organisations, once each, and only from tiers 1 and 2. Freshness halves every 10 hours, so this ranking is a snapshot and will differ at the next build.
What happened
Fake GitHub repositories posing as two PS5 projects, the KytyPS5 emulator and the AnyPS5 porting tool, are being used to spread password-stealing malware, according to NordVPN's Threat Intelligence team. As reported by Tom's Hardware, visitors get pointed to a ZIP file whose Windows executable unpacks a hidden multi-stage loader. The loader first checks whether it's on a real gaming PC, and exits if the system has less than 2 GB of RAM or no physical GPU, or looks like a virtual machine or cloud server. It seems built to dodge sandboxes and security researchers. Here's how NordVPN CTO Marijus Briedis put it: Emulation fans are a perfect target.
How this story arrived
Ordered by when each source was first observed, which is what the velocity figure is computed from. Publishers backdate; observed order does not.
- 01 Techpowerup first seen PSA: Fake KytyPS5 and AnyPS5 Repos on GitHub Are Spreading Malware
Overclock clusters coverage from independent sources and grades it automatically. The figures above are computed, not editorial. This page summarises and links to reporting by the outlets named — follow the links for the original work.