Fortnite players risk becoming victims of malware infections on their phones, following the decision of developer Epic Games to bypass the Google Play Store in favour of publishing the game to its own website, security experts have warned.

The popular battle royale game, which is already available on PC, home consoles and iOS, is now available on select Samsung devices – and will be on other Android phones soon. But in an unusual decision, Epic Games won’t publish Fortnite to Google’s main Android App Store, instead hosting the app for download itself.

Parents are paying tutors to stop their kids getting owned at Fortnite Read more

Unlike iOS, Android allows users to install apps downloaded from the internet, and even to install competing app stores altogether. But the option is disabled by default, and security experts have warned that this is for good reason.

“Epic Games’ decision to publish the Android version of Fortnite outside of the Play Store is a very poor choice for the security of their players,” said Rob Shapland, principle cyber security consultant at Falanx Group.

“Android devices are already far more susceptible to malware than Apple devices, with the greatest protection being to always download apps from the Play Store as these apps are screened for malware, which prevents most malicious apps from being installed,” Shapland added. “By encouraging users to download Fortnite outside of the Play Store, Epic Games leave their players vulnerable to malicious copycat apps being installed accidentally if they go to the wrong site.”

The threat of an attack isn’t hypothetical. Even before Epic announced that Fortnite would be coming to Android, the game was frequently used by malicious actors as bait to encourage naive users to install malware, hand over their payment details or simply watch adverts, said Sean Sullivan, a security adviser at F-Secure. “One useless app would prompt for installation of three additional apps.

“This sort of scenario is very discouraging. I would like to believe that young people will be more immune to scams – but the free-to-play app market and YouTube chaff is basically conditioning them to ignore best practices of any sort. They carefully vet nothing.”

As well as offering the immediate risk of malware infections, Epic’s decision risks undermining the general security of the Android ecosystem, Lukas Stefanko, malware analyst at ESET, said. “If the producers of other popular games follow Fortnite’s footsteps and start to bypass the Google Play Store, this could have a dangerous impact on the security of those playing the games on Android, as they would be far more vulnerable to installing apps from unknown sources, which could be malicious.”

Shapland concurred, noting that the move “normalises the behaviour of downloading apps from outside of Play Store, which can only lead to more malicious apps being installed in the long term”.

Google’s control of the Android app ecosystem has been a mixed blessing for the company. By acting as an effective gatekeeper, it has managed to keep a lid on malware on the platform, as well as guard against fragmentation, ensuring that most Android apps can run on most Android phones. But the company has also been found to be abusing its monopoly, leading in part to a multi-billion euro fine from the EU Competition Commission.