ESET, a digital security company, has discovered fake apps on Google Play that target a game, Pokémon GO’s hungry hordes.
ESET says the apps, though available on Google Play for only a short time, managed a number of downloads which include: ‘Install Pokemongo’ which attracted 10,000 – 50,000 victims, the ‘Guide & Cheats for Pokemon Go’ reached between 100 – 500, and the most dangerous of them, ‘Pokemon Go Ultimate’ reached 500 – 1,000 downloads.
[quote font=”georgia” font_size=”22″ font_style=”italic” align=”left” arrow=”yes”]“Users must resort to restart their devices device either by pulling out the battery or using Android Device Manager. After reboot, it runs in the background, invisible to the victim, silently clicking on porn advertisements,” ESET adds.[/quote]The company says all the fake apps discovered by its researchers and detected by ESET Mobile Security have already been removed from the store at ESET’s recommendation.
“‘Pokemon Go Ultimate’ resembles a version of the much hyped game but its true functionality is malicious,” says ESET. “It deliberately locks the screen immediately after startup. In many cases, reboot – the intuitive solution for a frozen screen – is not available because the app overlays all the other apps as well as the system windows.”
“Users must resort to restart their devices device either by pulling out the battery or using Android Device Manager. After reboot, it runs in the background, invisible to the victim, silently clicking on porn advertisements,” ESET adds.
Lukas Stefanko, ESET Malware Researcher explains that “Pokemon Go Ultimate is the first observation on Google Play of lockscreen functionality being successfully used in a fake app.”
“As its ultimate functionality is clicking on porn ads, it’s not truly damaging. But as for its lockscreen functionality, it would only take adding a ransom message to create the first lockscreen ransomware on Google Play,” Stefanko said.
ESET says these fake apps trick their victims into paying for unnecessary services, promising to generate Pokecoins, Pokeballs or Lucky Eggs – up to 999.999 each day, and that they lure victims into subscribing to expensive bogus services.
Stefanko laments that despite warnings, users keep downloading anything they see online without verifying its source.
“Despite of all the warnings by security experts, users tend to accept the risks and download anything to catch all the Pokémon,” notes Stefanko. “Those who really can’t resist the temptation should at least follow the most basic security rules.”
ESET experts remind users to only download apps from reputable sources, and use a mobile security solution that can scan and identify malicious apps, as well as check permissions to ensure apps are not accessing unnecessary information.