PlayStation users are being warned about a new scam that uses fake PS5 emulator downloads to infect PCs with malware capable of stealing personal data. The threat was identified by NordVPN's Threat Intelligence research team, which reports that cyber criminals are exploiting the popularity of Sony's console to lure gamers into installing dangerous software.
How the Fake PS5 Emulator Works
The fraudulent download promises to turn laptops and desktop PCs into fully working PS5 consoles, allowing fans to play top titles without needing to buy or use their Sony hardware. However, once the zip file is installed, it does not transform the device into a gaming machine. Instead, it unpacks a hidden application and launches a multi-stage loader that checks whether it is running on a real victim's machine.
If the checks pass, the malware quietly adds exclusion rules to the Microsoft Defender platform. This tactic ensures that antivirus software never scans the folders where the virus operates. Once everything is in place, the bug decrypts and runs its final payload, which NordVPN's analysts believe is an infostealer—a type of malware designed to steal passwords and other sensitive data. The payload is not yet documented in any public source.
Why Gamers Are at Risk
According to NordVPN, emulation fans are a prime target for this scam. Marijus Briedis, chief technology officer at NordVPN, said: "Emulation fans are a perfect target. They are used to downloading experimental software from GitHub and running unsigned files, so nothing about this feels suspicious."
Briedis added: "But this is not an emulator. It steals your data, hides from your antivirus, and erases its own tracks before you notice anything is wrong."
What PlayStation Users Should Do
All PlayStation fans are urged to watch out for PS5 emulators and avoid installing any software on their PC without checking it first. If you believe you have already run a suspicious file, NordVPN advises disconnecting from the internet, changing your passwords from a different device, and running a full antivirus scan.
