Mobile Fraud Intelligence (MFI)

No cross-case beneficiary/session/telecom graph establishing a shared operator or cash-out network.

Independent repeated financial/telecom linkage.

No measured before/after outcome data establishes whether 2026 Sanad banking identity adoption and wallet linkage reduce account/wallet takeover or merely shift attacker tactics.

Normalized pre/post fraud rates; new-device/re-enrollment losses; provider/CBJ control-bypass telemetry.

No verified Jordan/MENA victim evidence for NFC relay / Ghost Tap was recovered despite rapid global operationalization of the technique.

Bank/card-issuer/CERT/IR telemetry; victim APK/C2; NFC/card/POS/ATM evidence in Jordan/MENA.

No direct Jordan/MENA victim telemetry, bank/provider logs, local IOC hits, transaction authorization-path evidence or authority attribution ties CyberDakait to the region.

Jordan/MENA victim artifacts, provider/bank session and transaction logs, matched IOCs, authoritative incident reporting and cash-out evidence.

Definitive common-operator proof across all seven CyberDakait families remains missing.

Shared administrative artifacts, infrastructure ownership continuity, code provenance, operator handles or monetization-backend linkage across families.

No direct Jordan/MENA victim telemetry, bank/provider logs, local IOC hits, transaction authorization-path evidence or authority attribution ties CyberDakait to the region.

Jordan/MENA victim artifacts, provider/bank session and transaction logs, matched IOCs, authoritative incident reporting and cash-out evidence.

Official consolidated count of affected institutions, successful incidents and confirmed monetary losses remains unavailable.

Official CERT-In/RBI/police aggregation or deduped institution-level verified incident/loss dataset.

Evidence linking specific payment-API incidents to ARTEX, CyberStrike or a named operator remains incomplete/source-qualified.

Incident-specific controller/session artifacts, infrastructure control evidence, tool fingerprints and independent attribution.

No authorized carrier telemetry establishes which, if any, Jordan/MENA zero-rating configurations are currently susceptible.

Operator billing/DPI telemetry or authorized carrier/lab validation tied to specific zero-rated services.

KOFnet/vendor claims about specific active hosts/configurations were not independently validated against carrier billing records.

Independent authorized carrier billing/session evidence for named configurations.

Independent same-cluster telemetry or infrastructure evidence for MR ROBOT was not recovered; most public same-cluster coverage is derivative of the CloudSEK origin.

Independent malware/sample analysis, infrastructure ownership/history, provider/bank telemetry or separate victim/affiliate datasets.

The relationship between MR ROBOT and RedWing/FatBoyPanel remains unproven beyond overlapping MaaS and mobile-banking-fraud techniques.

Shared code provenance, signer/build lineage, administrative infrastructure, operator handles, licensing backend or independently linked monetization infrastructure.