Surge of Pokemon Go-related apps is out to steal your data

If permission is granted, the apps can collect contacts lists, photos and even login credentials to social media accounts. They can even take control of a phone’s camera and microphone.

RiskIQ has detected 172 unofficial Pokemon Go-related apps. Salisbury estimated that over half of them suspiciously gather more user information than they need.

Any data collected could be traded for profit. A developer could sell it to legitimate marketing firms or on the black market, he warned.

Salisbury found an app called Fake GPS for Pokemon Go on the Google Play Store that essentially allows a player to cheat. But the app also asks for permission to send SMS text messages.

In a worst case scenario, the app could secretly shoot off SMS messages to a premium rate number, generating money for the developers.

It’s no surprise if unscrupulous people are trying to cash-in on the Pokemon Go craze. Hit mobile games usually result in copycat titles, some of which carry Trojans. Hackers have also been known to clone legitimate banking apps and use them to trick users in handing over their data.

In the case of Pokemon Go, users who download the unofficial apps are likely unaware that they may be handing over access to sensitive data, Salisbury said. They may think products like the Pokemon Go music player are harmless.

“Who doesn’t want to listen to the Pokemon Go theme song?” he said. But users should be watchful over the permissions the apps ask for.

Fifty-seven of these unofficial Pokemon Go apps were found on AppBrain, a third party Android market. Others were found on Google Play and Apple’s App Store.