Igexin, the developer of an advertising software kit, has been caught collecting user data and sending it back to servers in China. Their kit was used in 500 legitimate applications and used the permissions granted to those apps to collect data such as call logs. Google has disabled the compromised applications while the developers replace the advertising APIs.
https://www.notebookcheck.net/Igexin-use-their-advertising-SDK-to-siphon-user-data-back-to-their-servers-in-China.242800.0.html