UPDATED 01:33 EDT / JULY 12 2016

NEWS

Malware infected version of Pokemon GO is being distributed on third party app sites

A malicious version of the popular Pokemon GO augmented reality game has been discovered on third-party sites, targeting users who are looking to playing the game but are unable to download it officially in their own country as of yet.

Researchers at security firm Proofpoint, Inc. discovered an infected Android version of the newly released mobile game Pokemon GO that has been modified to include the malicious remote access tool (RAT) called DroidJack (also known as SandroRAT), which would virtually give an attacker full control over a victim’s phone.

The malicious APK is said to have been uploaded to a malicious file repository service less than 72 hours after the game was officially released in New Zealand and Australia, the first countries where the game was available.

“Likely due to the fact that the game had not been officially released globally at the same time, many gamers wishing to access the game before it was released in their region resorted to downloading the APK from third parties,” Proofpoint explained. “Additionally, many large media outlets provided instructions on how to download the game from a third party. Some even went further and described how to install the APK downloaded from a third party.”

Ongoing risk

“The main attack vector used in today’s mobile app market is to take popular mobile apps, usually games, repackaging them while including some extra functionality ranging from advertisements, malvertisements and all the way through RATs (remote access tools),” Amit Ashbel, Director of Product Marketing & Cyber Security evangelist at Checkmarx explained to SiliconANGLE via email.

“The risk is usually more relevant for Android users who have a wider variety of app markets to download applications from. Many of those are not controlled or managed to sift out fake or malicious applications. However jail broken iOS devices are also exposed to a similar risk by opening up the platform to functionality which Apple doesn’t approve within their standard vanilla device operating system, thus allowing to download from alternative application markets.”

“Avoiding most of these types of attacks is quite simple for the user by making sure to download applications through either the Google Play store or the Apple apps stores.”

If you have downloaded a copy of Pokemon GO from a non-official source and fear you may have been infected all the details on how to check and how to remove the infection are available from Proofpoint here.

Image credit: sadiediane/Flickr/CC by 2.0

A message from John Furrier, co-founder of SiliconANGLE:

Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities.

  • 15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more
  • 11.4k+ theCUBE alumni — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network.
About SiliconANGLE Media
SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI.

Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.