Chinese E-Commerce Giant Pinduoduo In Malware Scandal

In the last couple of weeks, multiple Chinese security researchers have roundly accused Pinduoduo, a rising e-commerce giant that boasts almost 800 million active users, of making apps for Android that contain malware designed to monitor users. 

This scandal borders on data privacy infringement that may cost Pinduoduo quite a lot.

On Monday, Google announced that it had flagged several apps made by a Chinese e-commerce giant as malware, alerting users who had them installed, and suspended the company’s official app. 

Ed Fernandez, a Google spokesperson, said that “off-Play versions of this app that have been found to contain malware have been enforced on via Google Play Protect,” referring to apps that are not on Google Play.

Effectively, Google has set Google Play Protect, its Android security mechanism, to block users from installing these malicious apps and warn those who have them already installed, prompting them to uninstall the apps. 

Fernandez added that Google has suspended Pinduoduo’s official app on the Play Store “for security concerns while we continue our investigation.”

A security researcher, who asked to be anonymous, confirmed the claims against the apps and said they analyzed the apps as well, finding that the apps were exploiting several zero-days to hack their users. 

Pinduoduo did not respond to a request for comment.

In a confirmatory test, any attempt to install one of the suspected malicious apps pops up a message by Google alerting that the app is malicious. 

It is important to note that Google Play is not available in China, and according to anonymous security researchers, the malicious apps were present on the custom app stores of the phone manufacturers Samsung, Huawei, Oppo, and Xiaomi.

None of these companies responded to a request for comment.