People all over have been trying to enjoy the new Pokémon Go app, which released this week to so much fanfare that it’s experiencing massive server overload. The hype was so real that people were passing around APK files so that people outside the countries where it’s available could side-load it on Android, something I saw in my own friend groups.
Security firm Proofpoint is now cautioning those who couldn’t wait for an official app store release, saying that one specific APK was modified to install a backdoor called DroidJack. The app is different form the official version, but is close enough to fool anyone who may have picked it up.
The firm discovered the infected Android version of the app less than 72 hours after the game was released in New Zealand and Australia on July 4.
Proofpoint highlights some ways to tell if this particular version has been installed. For example, in the list of permissions (which you can access by going to your Settings, then Apps, and finding Pokémon Go), you’ll see some that aren’t typical of apps that let you catch creatures in augmented reality:
The firm also noted that going deep into the game’s files highlights some fake starter classes (including one called net.droidjack.server).
Proofpoint has a full list of warning signs over at the blog.
Downloading an app from a third party doesn’t necessarily mean that you’ll be infected with a virus, but it certainly ups the risk. The fact that the game is being slowly rolled out around the globe is only increasing the chances of someone getting infected with DroidJack.
“Bottom line, just because you can get the latest software on your device does not mean that you should,” the company wrote. “Instead, downloading available applications from legitimate app stores is the best way to avoid compromising your device and the networks it accesses.”