Sony PlayStation users face a new scam that uses the promise of free PS5 emulators to trick gamers into downloading malware onto their PCs, according to NordVPN's Threat Intelligence research team. The malicious software is designed to harvest passwords and other sensitive personal information.
How the scam works
The attack offers a download that claims to turn any laptop or desktop PC into a fully functional PS5, letting gamers play popular PlayStation titles without buying extra hardware. With the console costing around £500, the offer can seem tempting.
Instead of transforming a computer into a gaming machine, the downloaded ZIP file unpacks a hidden application and launches a multi-stage malware loader. This loader first checks whether it is running on a genuine victim's machine before proceeding.
Malware disables antivirus protection
If the checks succeed, the malware quietly adds exclusion rules to Microsoft Defender, creating blind spots in Windows' built-in antivirus protection so it does not scan the folders where the malicious software operates. With those safeguards removed, the malware decrypts and launches its final payload, which NordVPN's researchers believe is an infostealer designed to harvest passwords and other sensitive data. The final payload has yet to be documented in any public source.
Marijus Briedis, chief technology officer at NordVPN, says: "Emulation fans are a perfect target. They are used to downloading experimental software from GitHub and running unsigned files, so nothing about this feels suspicious." He adds: "But this is not an emulator. It steals your data, hides from your antivirus, and erases its own tracks before you notice anything is wrong."
What PlayStation users should do
PlayStation fans should be wary of websites offering PS5 emulators and avoid downloading unfamiliar software without first checking that it comes from a trusted source. Anyone who thinks they may have already installed the malicious file should disconnect the infected computer from the internet, change passwords using a separate, trusted device, and run a full antivirus scan.
