We discovered a Pokémon Go Trojan in Google Play. It had already been downloaded 500,000 times.