It's been a long time since I have had a look at Android permissions; is there any legitimate usecase for the "BIND_NOTIFICATION_LISTENER_SERVICE" permission used in the app ?
It also feels very wrong that a non-system app would be able to interract with the inline reply field of the notification, is this ability tied to the permission itself ?
In any case, this obviously targets the less savvy users and it would probably be better labelled as "phishing" rather than "wormable".
In any case, this obviously targets the less savvy users and it would probably be better labelled as "phishing" rather than "wormable".