Update: For details on how to install Pokemon Go, see How you can download Pokemon Go in South Africa.
If you have downloaded Pokemon GO from an untrusted third-party source, you may have just infected your smartphone with malware.
This follows a report by security company Proofpoint which discovered a malicious remote access tool side-loaded onto the Pokemon GO app, just 72 hours after the game’s official Australian release.
Many gamers wishing to access the game before it was released in their region resorted to downloading the APK from third parties.
Additionally, many large media outlets provided instructions on how to download the game from a third party [4,5,6]. Some even went further and described how to install the APK downloaded from a third party.
Luckily, there is a relatively simple step to check if your phone is infected with malware:
- First, they may check the SHA256 hash of the downloaded APK. The legitimate application that has been often linked to by media outlets has a hash of 8bf2b0865bef06906cd854492dece202482c04ce9c5e881e02d2b6235661ab67, although it is possible that there are updated versions already released. The malicious APK that we analyzed has a SHA256 hash of 15db22fd7d961f4d4bd96052024d353b3ff4bd135835d2644d94d74c925af3c4.
- Another simple method to check if a device is infected would be to check the installed application’s permissions, which can typically be accessed by first going to Settings -> Apps -> Pokemon GO and then scrolling down to the PERMISSIONS section. If any of the granted permissions seem suspicious to you, delete the app immediately.
Pokemon GO is only officially availabl in North America, Australia and New Zealand, with other territories expected to receive support in the near future.
Are you currently playing Pokemon GO? What do you think of it? Let us know in the comments below and in our forums.
More gaming news
How to get FTTH to come to your neighbourhood
The best multiplayer PC games of 2016 (so far)
AMD Radeon RX 470 and RX 460 official specifications revealed
Loading ...
If you can’t get it off the Play Store then the only other trustworthy way is off APKMirror. It’s run by the Android Police guys.
SHA256 on APKMirror matches the official SHA.
Also, MyGaming you may want to fix your formatting on the site. The last 3 characters on the SHA are cut off on a 1600×900 screen.