While the hugely popular Pokemon GO mobile game is only available in select countries (so far), it has already managed to hook millions of players. And like almost everything that manages to capture a wide reach, cybercriminals are already looking to join the craze.

Shortly after the game was released in July 6, a fake version of it—one that installed a remote access trojan on Android mobiles—was found on third party file-sharing sites. Not long after this discovery, security researchers found another malicious app—this time a fake lockscreen app—on Google Play named “Pokemon GO Ultimate”. The app deliberately locks the screen once the app is started, forcing the user to restart the device. After reboot, it runs surreptitiously in the background, silently clicking on porn ads online without the user’s knowledge. The Google Play download does not install any Pokemon GO Ultimate app onto the mobile; instead, an app using the name “PI Network” with a different icon was added.

The Pokemon-related threats on the app store don’t stop there. More bogus apps such as “Guide and Cheats for Pokemon GO” and “Install Pokemon GO ” on Google Play was also found delivering scareware pop-ups and advertisements that are designed to trick users into buying expensive, unnecessary services. One of them claims that the device is infected and needs to be cleaned, but in reality, clicking on the links would cause the user to unwittingly send a subscription SMS to expensive services.

Among these identified malicious apps, “Pokemon GO Ultimate” posed the biggest threat as it locks the screen of devices. Infected phones can be ultimately unlocked by either removing the battery or by using the Android Device Manager.

The widely popular augmented reality game shows no signs of slowing down, and cybercriminals are expected to capitalize on it by selling their wares in legitimate app stores such as Google Play. Attackers are also keen on taking advantage of the hype around the game by offering catchy apps—or tempting links to malicious sites—that promise to “help” boost players’ gaming experience. Because of this, it is important for players to learn and understand the risks that come with the game—both in the real world and in its virtual domain where threats come as fast as they can. While Pokemon GO gains more and more traction, there is no doubt that attackers will continue to plague the game with malware and other threats. Here are some tips on how to be safe while “catching ‘em all”:

1.       Download only from legitimate app stores – a user is more likely to get infected by apps downloaded from third party services. It is always better to wait and download from official stores.

2.       Read the app’s terms and conditions, and be aware of the permissions granted– cybercriminals will always try to sneak their malicious wares into legitimate stores. Be wary of copycat apps and unlicensed “cheat” apps. Reading the terms and knowing what permissions are granted to the app can help the user not only understand what they are getting into, but it helps them determine what is fake and what is legitimate.

3.       Check user reviews from credible sources – many reviews on app stores could be fabricated, hence, it is best to check from reputable developers and users.

4.       Use a robust mobile security solution – while being careful helps, a security solution can further lessen the chances of running into malicious apps and links.