Kaspersky: some versions of Pinduoduo, suspended by Google from its app store, exploited Android vulnerabilities to install backdoors and gain user data access
Security researchers at Moscow-based Kaspersky Lab have identified and outlined potential malware in versions …
Context & Ripple Effects
Six days after Google pulled Pinduoduo from the Play Store over "security concerns", Kaspersky has supplied the technical explanation for why: certain versions of the app actively exploited Android vulnerabilities to plant backdoors and reach user data, rather than merely violating store policy.
The finding moves the story from a moderation action to an exploitation case, putting it in the same lineage as the Joker infections that spread through Huawei's AppGallery after plaguing the Play Store and Kaspersky's earlier documentation of Play Store spyware campaigns — evidence that both official and alternative Android distribution channels keep producing malicious-app incidents.
First-order effects
- Users who installed the affected Pinduoduo versions are exposed through installed backdoors regardless of whether they got the app from Google Play or outside it — Google had already flagged several Pinduoduo apps as malware and alerted installers.
- Pinduoduo's Play Store absence is now effectively permanent until the exploit behavior is verifiably removed, and Google's malware flagging gives other platforms grounds to re-examine its listings.
Second-order effects
- Other high-volume Chinese consumer apps distributing outside the Play Store face heightened scrutiny from reviewers and enterprises, since the Joker/AppGallery precedent shows alternative stores inherit the same trust problem once one major app turns malicious.
- Android device makers and carriers come under pressure to patch the exploited vulnerabilities quickly, because the attack chain depends on OS-level flaws rather than user deception alone.
Third-order effects
- If exploit-bearing apps keep surfacing on major e-commerce scale, app distribution shifts further toward stricter runtime attestation and vendor reputation systems, narrowing how much freedom any Android storefront — official or not — can grant third-party apps.
The trend: Android's app ecosystems — Play Store and alternative storefronts alike — are being pushed toward continuous behavioral vetting as high-profile apps repeatedly cross from policy violations into active exploitation.