Fake websites for PlayStation 5 games on PC are stealing codes
Malicious domains and fake repositories impersonating popular PS5 gaming projects are circulating on GitHub, distributing password-stealing malware equipped with sandbox-evasion checks and defense evasion routines. A
Malicious domains and fake repositories impersonating popular PS5 gaming projects are circulating on GitHub, distributing password-stealing malware equipped with sandbox-evasion checks and defense evasion routines.
According to security researchers at NordVPN, the attackers are creating copies of the pages for the popular AnyPS5 and KytyPS5 programs. Users looking for a way to enjoy the console's games without buying it are easily fooled, as the fake pages are hosted on popular websites that are commonly used to host code.
How the trap works
Fake pages offer downloads that look like legitimate programs, but in reality they contain dangerous software designed to steal passwords and personal data.
Before it can do any damage, the malicious program checks whether it is running on a regular computer or in a test environment used by security experts. If it finds that the computer is low on memory, running in virtual mode, or has no graphics card, it immediately shuts down without being noticed. On the other hand, if it passes the checks, it secretly adds exclusion settings to the Windows protection system so that it cannot be detected by the antivirus.
The first consequences and warnings
The AnyPS5 community had warned early on via the Discord platform about the existence of a fake page containing suspicious code. Meanwhile, a Reddit user reported that he fell victim to the scam after downloading the fake installer, resulting in him receiving notifications within minutes that his accounts on popular gaming platforms were under attack. Other users also reported that they had detected attempts to spread dangerous software even within the technical support section of the KytyPS5 page.
β³
READ ALSO
HACKS.GR / RELATED
Cyber ββAttacks & Data Breaches
New prices and features for McAfee's renewed plans
β
Experts point out that those looking for experimental programs from unofficial sources are an ideal target for scammers, because they are already accustomed to downloading files from various sources on the Internet. Although these fake pages have already been removed, researchers warn that similar campaigns continue to appear constantly on constantly changing addresses.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
β
end of article
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.