How to avoid Pokemon Go malware

Pokémon Go, the smash hit game that brings Pokémon into the real world, is bringing about a litany of scary real-world consequences. Some players were robbed and one even discovered a dead body while exploring for Pokémon, among a lot of other weird stories.

And because Pokémon Go isn't out in every country just yet, players are looking up ways to get the game anyway possible, including downloading it from some dubious sources.



Researchers at Proofpoint, a cyber security company, announced the discovery of an infected Pokémon Go download, though it hasn't observed it in the wild yet. The infected app gives attackers full access to all of your personal information stored on your phone. If you don't want to be infected by the Pokémon Go malware, follow the steps below.

Identifying and avoiding Pokémon Go malware on Android

The best method of avoiding the Pokémon Go malware is to wait until the game is available in your country. But since you're probably not going to do that, here's how to be smart about sideloading the app on your Android phone.



Only download the APK file (Android application package) from sites you trust. Our very own Matt Hanson wrote up a detailed guide on how to download and play Pokémon Go right now, so hit that article up for a safe link to the APK.

Once you've downloaded the APK, check to see what type of permissions the app asks for. By default, Pokémon Go does ask for a lot of permissions, like access to your location, contacts and camera. However, the Pokémon Go malware will ask for even more permissions for things like making calls, reading your text messages, recording audio and looking at what apps run at startup. These permissions should be immediate red flags.



Once the infected Pokémon Go app is installed, it's extremely difficult to distinguish it from the official application. The malware-infected app looks and acts identical to the sanctioned Google Play store app, though users can still check the app's permissions to see if anything's out of the ordinary.

To do this, head to your Android Settings and scroll down to "Apps". Scroll until you find Pokémon Go and tap on it. Tap on "Permissions" and then the menu button (three dots) to see the option for "All permissions." This will reveal exactly what the app can do on your phone. Refer to the above images to see if there are any unnecessary permissions.

Although the Pokémon Go malware may not have been seen in the wild yet, it will only be a matter of time before enterprising criminals take advantage of the Pokémon hype by circulating the infected app.

Proofpoint doesn't tell users how to get rid of the malware after it's been installed, but one can assume the safest way is to perform a factory reset. It's annoying having to backup and restore data, but it's the only 100% effective way to get rid of Android malware.

Pokémon Go iOS players are safe, for now

Since iOS users have to sign up for a US, New Zealand or Australian Apple ID in order to download the app from the App Store, they're safe from this malware for now. The Apple ID work around allows users to download the official app from the App Store, which is safe. The only downside is that you'll have to use an alternate Apple ID until the app comes to your country.