How Alibaba’s Trusted Apps Enabled a Phishing Scam via Xianyu QR and Alipay
A victim scanned a Xianyu product‑share QR code that launched a chain through Xianyu, Taobao, and Alipay, loading a fake Xianyu page hosted on Qianwen’s CDN; because all domains were whitelisted, no external‑link warnings appeared, exposing systemic trust‑chain risks in the Alibaba ecosystem.
