Fake PS5 and Switch 2 Emulators Spreading Malware as Emulation Gains Momentum

The console emulation scene is on fire with devs getting busy with their projects for PlayStation 5 and Nintendo Switch 2. The increasing popularity of these projects has also caught the attention of malicious actors looking to prey on unsuspecting users. This has created a situation where legitimate development efforts and fraudulent downloads are increasingly appearing alongside each other.

Recent reports have shown that fake PS5 emulators are being spread through GitHub repositories, with some downloads containing malware aimed at stealing passwords and other personal information. Current generation consoles are attracting more interest, and security experts are advising users to be more careful about the software they download.

This isn’t necessarily a new problem, as malicious downloads have been floating around gaming communities for years.

Every time a new console or big game is in the spotlight, scam sites and ads pop up claiming to give you free access to emulators or software that will "enable" those systems on PC. Instead of downloading these programs, users may end up installing adware, password-stealing malware, or other unwanted software. However, recent developments around PS5 and Switch 2 emulation have created another opportunity for these malicious downloads to spread.

An investigation by NordVPN has shown that the company’s research team on threat intelligence has discovered fake PS5 emulators on GitHub that are pretending to be genuine software. “These malicious programs are said to contain information-stealing malware that can collect passwords and other sensitive personal data.

The investigation reveals how easily users can be fooled into downloading malicious repositories instead of legitimate development projects, especially when several downloads with similar names show up in search results. That means it’s becoming more important to check the source of an emulator before installing anything on your computer.

The investigation gave the example of a fraudulent repository using a similar name to Kyty, an existing PS5 emulation project. The difference is said to be small, with the fake adding an extra letter to the original name. Someone looking for the emulator might miss that tiny change and download the wrong software without realizing it.

The malware allegedly attempts to evade detection by altering Microsoft Defender settings and introducing exclusion rules to prevent specific files or folders from being scanned.

Once it is installed, the information stealer can steal passwords, banking details, and other personal information stored on the infected computer. It can also reportedly record keystrokes, which could allow attackers to capture information entered by the victim. The distributors of the malware then receive the stolen data. 

Meanwhile, real PS5 emulation projects continue to draw attention, as developers work to get more games running on PC hardware. One project in the emulation community is AnyPSX, which is not a traditional emulator but a translation layer to help bring PS5 games to PC.

The project works by mapping the console’s system libraries and translating the GPU shader instructions so the games can talk to PC hardware. It’s apparently racked up some 50,000 stars on GitHub, which shows the huge interest in projects that allow PS5 software to run outside its native environment.

The development process, however, is much more complex than translating the instructions of a game. Additional information that needs to be mapped has been discovered by the developers, and progress has been adjusted from approximately 80% to approximately 26%. This may seem like a major setback at first, but it shows how much work remains to make the project more widely compatible. 

Kyty has also demonstrated improvements through several demonstrations showing games running with varying levels of functionality. Earlier examples were relatively basic, but more recent footage reportedly includes titles such as Cyberpunk 2077, MLB The Show 23, UFC 6, Astro Bot, and Demon's Souls. One demonstration also reportedly showed Nvidia frame generation pushing performance beyond 100 FPS. These examples offer an indication of what could eventually become possible, although demonstrations should not be mistaken for proof that every game is already playable from beginning to end.

The Nintendo Switch 2 emulation scene is developing alongside these PS5 projects.

With the first publicly available emulator for the system on PC reportedly arriving under the name Eden NX2. The project is an experimental integration based on the existing Eden emulator and earlier Switch emulation work. The original Switch and the successor are similar on the architectural level, so developers are able to use the knowledge they picked up on earlier projects instead of having to start completely from scratch. 

Eden NX2 is still in a very early state; many functions and system calls are missing. Mario Kart is apparently running in demonstrations. Performance is apparently sitting around 60 FPS in some instances. But that doesn’t mean the emulator is ready for everyday use, as the experience can still involve crashes, freezes, and other compatibility issues. 

Other Nintendo Switch 2 games like Donkey Kong Bananza, Splatoon Raiders, Pokémon titles, and Pokopia have also been shown. Some have apparently managed to get to their title screens or show limited gameplay, but these results are still early signs of development, not proof of full compatibility.

For now, Eden NX2 is likely to be more useful to developers and people interested in testing emulation than ordinary players hoping to enjoy their entire game library on PC. Considerable work will be required before the project can provide a stable experience across a wider selection of games.

Nintendo has also continued taking action against unauthorized projects and videos involving its games.

The company has reportedly been targeting videos showing off mods, ports, and other uses of its copyrighted assets, including a demo showing off a Breath of the Wild port to PS5. Nintendo’s terms allow it to act against unauthorized modifications and uses of its intellectual property. These moves suggest that the company is still very protective of its software, even as emulation and fan projects continue to gain attention online.

Unlike simply downloading an emulator program, downloading game ROMs can carry some risks. A game dump shared in an emulation community shouldn't be assumed to be safe for users, as files from unofficial sources may contain malicious software. The Nintendo Switch 2 throws another wrinkle into the mix with tokens that are unique to each game cartridge. 

This has led to concerns about possible online bans for users who use shared Switch 2 ROM dumps. The situation is reminiscent of the earlier MIG Switch controversy, which also involved Nintendo's attention to cartridge-related issues. The exact implications can differ based on what the files are used for, but sharing or downloading game dumps without being aware of the restrictions that come with them may risk online access. 

There is a lot of interest in what Nintendo’s T239 chipset is capable of and what developers might eventually be able to do with overclocking and hardware modifications, on top of the current emulation projects. The original Nintendo Switch used Nvidia’s Tegra X1, which some manufacturers underclocked to improve battery life and thermal performance.

Enthusiasts later experimented with overclocked hardware and saw improved performance in games that struggled to maintain stable frame rates. Some of the tweaks even bumped the original Switch up to 8GB of RAM, proving just how far dedicated hardware enthusiasts will go.

This kind of experimentation could eventually be relevant for the Switch 2, but its hardware and software limitations must be resolved before any meaningful improvements can be made. The console chipset may provide some options for additional tinkering. Overclocking and unofficial mods also come with risks to heat, stability, and hardware longevity. It's too early to tell how far the community will go with the new system. 

It’s certainly remarkable to see the progress on PS5 and Nintendo Switch 2 emulation, especially considering how much work remains before either console can be reliably emulated on PC.

Projects like Kyty, AnyPSX, and Eden NX2 are examples of the dedication of developers trying to understand modern console hardware and software. But the increasing popularity of these projects has also made it easier for bad actors to distribute fraudulent downloads. Before installing unknown software, users should check the name of the repository, the activity of the developer, the contributors, and the download sources. Remember that the GitHub stars, forks, and a professional-looking page don't mean that a download is safe.

Ultimately, the main risk is that people who want to experiment with emulation could expose their personal information by downloading a fake app. A repository with a convincing name and a familiar-looking description may still hide malware, especially when malicious developers deliberately mimic legitimate projects.

The best practice is to stick to official development pages, avoid downloading anything suspicious, and be careful with unofficial ROM files. Emulation is still progressing, but as you look through these early projects, you still want to protect your computer and personal information.