Malicious GitHub repositories masquerading as two well-known and legitimate PS5 game emulation tools have been identified as spreading malware that steals gamers' passwords. The malware uses self-signed certificates, created using fake company names and on the same day the malware was built — suggesting that the malware campaign may be automated. Just two minutes after infection, a cleanup script scrubs the affected computer of the malware's files, leaving no trace that it was ever present, according to a report shared with Tom's Hardware by NordVPN's Threat Intelligence research team.

The campaign trades on the back of the popularity of two projects that have become popular within the PS5 emulation community. AnyPS5 is a portability layer that allows PS5 games to run as native applications on both Windows and Linux. Kyttyps5 is an emulator for running PS5 games on PCs, and both projects are freely available for download via their respective GitHub repositories. However, users who visit one of the malicious repositories posing as these tools are directed to download a zip file containing a Windows executable. Notably, the GitHub repositories used as part of the malware campaign rapidly rotate, and it's possible that GitHub is not the only source.

The malicious executable unpacks a hidden application before launching its own multi-stage loader. It first checks whether the PC is a legitimate machine or a security researcher's sandbox by checking if less than 2GB of RAM is available, if it's a virtual machine, if it's running on a cloud-based server, or if it doesn't have a physical GPU installed.

Source link