It's been a long time since I have had a look at Android permissions; is there any legitimate usecase for the "BIND_NOTIFICATION_LISTENER_SERVICE" permission used in the app ? It also feels very wrong that a non-system app would be able to interract with the inline reply field of the notification, is this ability tied to the permission itself ?

In any case, this obviously targets the less savvy users and it would probably be better labelled as "phishing" rather than "wormable".