China's Pinduoduo App Uses Malware to Spy on Users, Experts Say

Cybersecurity experts found that Chinese e-commerce giant Pinduoduo's app contains sophisticated malware exploiting Android vulnerabilities to spy on users. Researchers from WithSecure, Check Point Research and Oversecured identified code enabling privilege escalation, allowing the app to bypass security restrictions, monitor other apps, read private messages, change system settings, and prevent uninstallation. The malware specifically targeted Android systems used by Samsung, Huawei, Xiaomi and Oppo devices. A dedicated team of 100 engineers reportedly developed these exploits from 2020 until disbanding in March 2023 after Google suspended Pinduoduo from Play Store. The app updated in March 2023 removed visible exploits but underlying code remains. Pinduoduo serves over 750 million monthly users in China, where three quarters of smartphone users run Android. No evidence links the data collection to Chinese government requests, but Beijing's jurisdiction over domestic companies raises concerns. Pinduoduo's parent company PDD is listed on Nasdaq.