“Pokémon Go” has become arguably the hottest game for iPhone and Android.
Nintendo's new location-based augmented reality game allows players to catch Pokémon in real life using their device's camera and is currently only officially available in the United States, New Zealand, the United Kingdom, and Australia.
On average, users spend twice as much time playing the new Pokémon Go app than they do on other apps like Snapchat. In fact, Pokémon Go experienced a massive server overload within just a few days of its launch.
Due to the huge interest surrounding Pokémon Go, many gaming-related websites have offered tutorials recommending users to download the APK outside of Google Play.
To download the APK, users also have to download the malicious app by modifying Android's core security settings, allowing their device's OS to install apps from untrusted sources.
Security experts have warned users that many of these tutorials are linked to malicious versions of the Pokémon Go app that allow hackers to gain access to a user’s device.
Security firm Proofpoint has discovered the malicious app, or APK, infected with DroidJack – a remote access tool (RAT) that can access any Android device, opening the door for hackers.
Less than 3 days after Nintendo initially released the game in Australia and New Zealand on July 4, the malicious app was uploaded to an online malware detection repository.
Given that basic Android security settings normally prevent the installation of untrusted apps from unknown third-party sources, side-loading should not be done by any user.
