Fake Security App For AliPay Customers

This report analyzes an Android SMS‑stealing Trojan disguised as an AliPay “Security Controls” app (MD5: fad55b4432ed9eeb5d7426c55681586c, package com.bing.receive). The malware hides its icon, starts background services (MyService, DealService, TestService), registers broadcast receivers (including an SMS receiver and a system‑boot receiver), collects incoming SMS messages and forwards them via HTTP POST to a C2 server, and persists across reboots; the authors recommend uninstalling unknown apps, disabling unknown sources, and removing the app via Settings since it does not request device administrator privileges.