Malicious GitHub Repositories Impersonating AnyPS5 and KytyPS5 Found

Fake GitHub repositories using the names AnyPS5 and KytyPS5 infect those who want to run PS5 games on a PC with malware.

Security experts at NordVPN detected malicious GitHub repositories using the names AnyPS5 and KytyPS5. These repositories promise to run PS5 games on PC. However, in reality, it drops malicious software onto the user's computer.

Fake repositories ask the user to download a ZIP archive. The archive contains executable files that run on Windows. Therefore, someone who wants to try PS5 games on PC may open the file thinking it is a real project. Therefore, it is of great importance where the downloaded file comes from.

Both imitated names belong to known projects. AnyPS5 and KytyPS5 are known as solutions for running PS5 games on PC. Moreover, fake warehouses also bear the name of these projects. Therefore, the user who sees the names may think that the repository is trustworthy.

GitHub is an open platform for sharing software projects. However, just because a repository page is there does not indicate that the content is reliable. As a matter of fact, in this case, well-known project names were imitated.

When the file runs, exception rules are first added to Microsoft Defender. Defender is Windows' built-in security software. Locations defined as exceptions may be excluded from scanning. The malware then decrypts and executes its actual payload.

The infection chain works step by step as follows:

The ZIP archive is downloaded and the Windows file inside is run.

Exception rules are added to Microsoft Defender.

The malicious payload is decrypted and the payload is executed.

After about two minutes, the cleanup script deletes the files.

Researchers think the last working file was an information stealer. So the program may be designed to steal passwords and confidential data. Information stealer is a type of software that aims to collect sensitive data on the computer and deliver it to the attacker. This assessment is an estimate of the researchers, but the risk is serious.

Malware also tries to leave no trace. About two minutes after it is run, a cleaning script deletes the malware's files. Thus, it becomes difficult to examine the infection. Therefore, tracing contamination may not be easy even after the fact. In other words, when the user searches for the files later, he may not find any trace of malware.

In order not to get caught up in fake warehouses, it is enough to know the right owner. The AnyPS5 project is maintained by a user named boykopovar. The official repository of KytyPS5 belongs to the KytyPS5 organization. It is possible to easily access this information on the internet. These two pieces of information are the most practical way to distinguish fake warehouses.

Therefore, it is necessary to check the name of the repository owner before downloading. In addition, executable files extracted from ZIP should be approached with caution. Because a program that adds an exception to Defender bypasses the protection for those files.

ZIP archives submitted from another account should therefore not be considered reliable. The correct addresses for AnyPS5 and KytyPS5 are clear: boykopovar for AnyPS5, official repository of the KytyPS5 organization for KytyPS5.