This is according to the threat research arm of NordVPN.

fakeemulatorsgithubspreadingpassword-stealingmalware