We say it time and time again but one of the best ways to keep your Android device safe and malware-free is to only download apps from the Google Play store. Even trustworthy third-party app markets tend to be needlessly risky to install (looking at you Amazon Instant Video), and malicious apps thrive on stores with fewer regulations.

If you need more convincing consider this week's mobile threat tip, which was actually first spotted by a Malwarebytes forum member. Pou is a popular virtual pet game for iOS and Android. However, if you obtain it from Mobogenie's separate Android app store, you'll be getting some unwanted and potentially dangerous downloads along with a little brown alien to take care of. 

Pou Pou

According to Malwarebytes, if you download Pou from Mobogenie's app market, the game secretly installs a downloader add-on as well. The downloader is identified as Android/Trojan.Downloader.WalkFree.a. And don't confuse it with the Walk Free pedometer app also on the Mobogenie store, although as far as we know that app could contain the library as well since WalkFree is also bundled with other, unknown Mobogenie apps.

What makes WalkFree so threatening is that it installs apps without telling you. Apps are downloaded to a hidden folder called ".walkfree" on your device's external storage. Pou (or any other affected app) then pushes downloaded apps via the Notification bar. Unfortunately, these unwanted new APKs could very well be malware. For example, the Pou app downloaded an APK called com.polaris.BatteryIndicatorPro. In reality, this app was a Trojan identified as Trojan.Spy.Agent.el. Malware that leads to even more malware is a recurring tactic among hackers, as is exploiting fans of successful apps like Pou. 

Staying Safe

Again, the best way to stay safe if you're an Android owner is to stick to downloading apps from the Google Play store. The Malwarebytes forum member who first discovered WalkFree explained that the Trojan only appeared when they downloaded Pou from Mobogenie's store. The Google Play version was totally clean, so if you're interested in checking out the game for yourself you do have better options. We know that not everyone in the world has access to these officials channels, which helps malware like this spread, but if you do, there's really no excuse.

As always, you'll also want to get some kind of security software for your android device like Malwarebytes Anti-Malware for Android, as well as our Editors' Choice award winners Avast! Mobile Security & Antivirus and Bitdefender Mobile Security and Antivirus. Pou players should know the game only wants to give you something to love, so make sure you don't get saddled with malware, too.