Chinese Pinduoduo app exploited system vulnerabilities to escalate privileges to download and execute backdoors and gain unauthorized access to user data, notifications and files. The app was also removed from Google Play Store.
Original research: https://mp.weixin.qq.com/s/P_EYQxOEupqdU0BJMRqWsw
Context article: https://krebsonsecurity.com/2023/03/google-suspends-chinese-e-commerce-app-pinduoduo-over-malware/
New analysis report: https://github.com/davincifans101/pinduoduo_backdoor_detailed_report/blob/main/report_en.pdf