A malicious version of the popular Pokemon GO augmented reality game has been discovered on third-party sites, targeting users who are looking to playing the game but are unable to download it officially in their own country as of yet.

Researchers at security firm Proofpoint, Inc. discovered an infected Android version of the newly released mobile game Pokemon GO that has been modified to include the malicious remote access tool (RAT) called DroidJack (also known as SandroRAT), which would virtually give an attacker full control over a victim’s phone.

The malicious APK is said to have been uploaded to a malicious file repository service less than 72 hours after the game was officially released in New Zealand and Australia, the first countries where the game was available.

“Likely due to the fact that the game had not been officially released globally at the same time, many gamers wishing to access the game before it was released in their region resorted to downloading the APK from third parties,” Proofpoint explained. “Additionally, many large media outlets provided instructions on how to download the game from a third party. Some even went further and described how to install the APK downloaded from a third party.”

Ongoing risk

“The main attack vector used in today’s mobile app market is to take popular mobile apps, usually games, repackaging them while including some extra functionality ranging from advertisements, malvertisements and all the way through RATs (remote access tools),” Amit Ashbel, Director of Product Marketing & Cyber Security evangelist at Checkmarx explained to SiliconANGLE via email.

“The risk is usually more relevant for Android users who have a wider variety of app markets to download applications from. Many of those are not controlled or managed to sift out fake or malicious applications. However jail broken iOS devices are also exposed to a similar risk by opening up the platform to functionality which Apple doesn’t approve within their standard vanilla device operating system, thus allowing to download from alternative application markets.”

“Avoiding most of these types of attacks is quite simple for the user by making sure to download applications through either the Google Play store or the Apple apps stores.”

If you have downloaded a copy of Pokemon GO from a non-official source and fear you may have been infected all the details on how to check and how to remove the infection are available from Proofpoint here.

Image credit: sadiediane/Flickr/CC by 2.0