All PlayStation fans are being urged to watch out for a worrying new scam that could hand personal data over to hackers. The latest attack, which has been spotted by NordVPN’s Threat Intelligence research team, is using the promise of PS5 console emulators to infect PCs. Cyber crooks appear to be using PlayStation’s popular console as a way of luring gamers into downloading dangerous malware.
At first glance, things look hugely enticing, with a download that promises to turn laptops and desktop PCs into fully working PS5s. This means fans of the franchise can play top titles without needing to buy or fire up their Sony consoles.
However, once the zip file is installed, it doesn’t turn the device into a gaming machine. Instead, it unpacks a hidden application and launches a multi-stage loader where it checks whether it is running on a real victim’s machine.
If the checks pass, the malware quietly adds exclusion rules to the Microsoft Defender platform. It’s a clever tactic, as it means antivirus will never scan the folders where the virus then operates. Once everything is in place, the bug then decrypts and runs its final payload, which NordVPN’s analysts believe is an infostealer, a type of malware designed to steal passwords and other sensitive data. The payload is not yet documented in any public source.
“Emulation fans are a perfect target. They are used to downloading experimental software from GitHub and running unsigned files, so nothing about this feels suspicious,” says Marijus Briedis, chief technology officer at NordVPN.
“But this is not an emulator. It steals your data, hides from your antivirus, and erases its own tracks before you notice anything is wrong.”
It’s now vital that all PlayStation fans watch out for PS5 emulators and avoid installing any software on their PC without checking it first.
If you think you have already run a suspicious file, NordVPN says you must disconnect from the internet, change your passwords from a different device, and run a full antivirus scan.
