Cybercriminals are jumping on the huge popularity of AR app Pokemon Go to spread malware via social media scams, according to Proofpoint.
The security firm claimed that its researchers had discovered 543 social media accounts related to the Japanese game across Facebook, Twitter and Tumblr – over 30% of which are fraudulent.
Of these 167 phony accounts, 26% had links to download files – many masquerading as the Pokemon Go app, game guides or other related content.
Some 47% were branded as “imposter accounts,” while nearly 13% of accounts promised free giveaways, according to Proofpoint.
Users clicking through accounts promising downloads are greeted with adware, malware or software “other than the one advertised,” the firm added.
Although desktop and mobile users are both affected by these scams, there’s special affinity with the mobile platform, given many threats appear to be targeting Android.
“It’s important to note that while we have seen at least three malicious versions of Pokémon GO, social media is also driving users to install Android APKs, which happen to be malware…Power ups, guides, and walkthroughs are all common and easy ways to draw users’ attention as these are compelling tools that help players in the game,” said Proofpoint.
“Cyber criminals are bringing a full suite of attacks to the table with Pokémon Go: from compromised apps to fraudulent social media sites and phishing social posts that lead to more mobile malware… the list goes on.”
There’s a potential corporate security risk here also, if mobile devices or laptops become infected and then connect to a network without adequate malware detection functionality.
Pokemon Go is simply the latest, but certainly not the last, big name ‘event’ latched onto by the cybercriminal underground in a bid to scam users and/or infect their devices. In that respect it’s a similar tactic to that employed before and during the Rio Olympics.
“As the popularity and novelty of Pokemon GO eventually wanes, attackers will be looking for the ‘next big thing,’ exploiting attention on the holidays, presidential elections, major sporting events, and more,” Proofpoint warned.