Electronic Wallet Balance Theft — Jordan & Palestine — Mobile Fraud Intelligence (MFI)
PASSغير مسجلة
التاريخ
٢٩/١٠/٢٠٢٦
الدومين
Mobile Fraud Intelligence (MFI)
الموضوع
Electronic Wallet Balance Theft — Jordan & Palestine
الحالة
PASS
النتائج المتحققة
لا يوجد
التناقضات والقيود
UNKNOWN: Q1 2026 reporting recorded 27 official-impersonation sites/social pages and 113 incidents involving bypass of digital-identity verification and account manipulation.
حد الدليل: Does not measure Android-banker prevalence, consumer-wallet victim count or a single campaign/operator.
UNKNOWN: PSD renewed its warning after continued complaints about audio/video calls impersonating security officers; obtained personal data were then used to steal accounts or financial balances.
حد الدليل: Does not prove malware infection, one operator or exact financial rail.
UNKNOWN: The Ministry of Digital Economy warned of messages impersonating Sanad and official logos, requesting payments, personal-data updates or parcel tracking and soliciting sensitive/OTP data.
حد الدليل: Does not prove compromise of Sanad, malware infection or successful loss in a specific case.
UNKNOWN: CBJ warned of WhatsApp messages claiming ATM cards were blocked for failure to update customer data and directing users to foreign numbers, with aims including device compromise, financial/data theft or extortion.
حد الدليل: Does not prove CBJ breach, malware installation or victim loss.
UNKNOWN: CBJ adopted Sanad digital identity across banks as an official identity-verification method equivalent to traditional identification for banking services.
حد الدليل: Does not prove fraud reduction or eliminate post-authentication/social-engineering/device risks.
UNKNOWN: CBJ circular 26/2/7487 dated 2026-05-03 requires linking electronic wallets to the Sanad application.
حد الدليل: Does not prove lower fraud rates or block social engineering, malware, SIM/eSIM abuse or APP scams.
UNKNOWN: JoPACC reported 363.84M transactions in 2025 (+62%), 102.04M JoMoPay transactions (+79.7%) and 2.81M mobile-wallet users at year-end 2025.
حد الدليل: Does not measure fraud incidence, victim count, malware prevalence or fraud rate.
UNKNOWN: PT ESC found DragonDoll in a Saudi-targeting campaign masquerading as a critical Chrome update; it abuses Accessibility and collects notifications/SMS and messaging content with Arabic localization among many languages.
حد الدليل: Does not prove Jordan infection, financial theft in every case or common operator with MFI complaints.
UNKNOWN: Group-IB documented Vwork weaponizing Android Work Profile app cloning for Gigabud; compatible samples targeted Egypt, Morocco, Türkiye and a GCC member state, while confirmed infection in the report was Indonesia.
حد الدليل: Targeting configuration does not prove MENA/Jordan infection.
UNKNOWN: Kaspersky found malicious loaders directly on Google Play; a trojanized PDF reader dropped Anatsa after showing a fake update request.
حد الدليل: Does not make official stores generally unsafe or prove Jordan activity.
UNKNOWN: Cleafy documented two unrelated Android NFC-relay families actively used for fraud, combining social engineering, card tapping, PIN harvesting and in some flows SMS/OTP interception.
حد الدليل: Does not establish Jordan/MENA deployment or victimization.
UNKNOWN: Group-IB documented a commercial Android Ghost Tap ecosystem relaying card communications for remote POS/cash-out; more than 54 APK samples were identified and fraud was observed.
حد الدليل: Does not establish Jordan/MENA campaigns or linkage to MFI actors.
UNKNOWN: Kaspersky reported malicious apps on Google Play and the App Store containing SparkCat and 162,275 mobile-banking-Trojan installation packages in Q1 KSN telemetry.
حد الدليل: Does not imply official stores are broadly compromised or provide Jordan prevalence.
المتابعة المفتوحة
OPEN [MEDIUM]: METHOD_TELEMETRY — Cybersecurity-specific Method Yield telemetry is not yet empirically calibrated.
OPEN [HIGH]: CONTROL_EFFECTIVENESS — No measured before/after outcome data establishes whether 2026 Sanad banking identity adoption and wallet linkage reduce account/wallet takeover or merely shift attacker tactics.
OPEN [MEDIUM-HIGH]: NFC_REGIONAL_VALIDATION — No verified Jordan/MENA victim evidence for NFC relay / Ghost Tap was recovered despite rapid global operationalization of the technique.
المصادر
NCSC via Petrahttps://org.petra.gov.jo/Include/InnerPage.jsp?ID=357947&lang=ar&name=news
Petra / Cybercrime Unithttps://org.petra.gov.jo/Include/InnerPage.jsp?ID=361306&lang=ar&name=news
MODEE via Petrahttps://org.petra.gov.jo/Include/InnerPage.jsp?ID=359686&lang=ar&name=news
Central Bank of Jordanhttps://www.cbj.gov.jo/Ar/NewsDetails/%D8%AA%D8%AD%D8%B0%D9%8A%D8%B1_%D8%A3%D9%85%D9%86%D9%8A_%D9%85%D9%86_%D9%85%D8%AD%D8%A7%D9%88%D9%84%D8%A7%D8%AA_%D8%AE%D8%AF%D8%A7%D8%B9_%D8%A5%D9%84%D9%83%D8%AA%D8%B1%D9%88%D9%86%D9%8A%D8%A9_%D8%AA%D8%B3%D8%AA%D8%AE%D8%AF%D9%85_%D8%A7%D8%B3%D9%85_%D8%A7%D9%84%D8%A8%D9%86%D9%83_%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2%D9%8A_%D8%A7%D9%84%D8%A3%D8%B1%D8%AF%D9%86%D9%8A___
Central Bank of Jordanhttps://www.cbj.gov.jo/AR/List/%D8%AA%D8%B4%D8%B1%D9%8A%D8%B9%D8%A7%D8%AA_%D8%A7%D9%86%D8%B8%D9%85%D8%A9_%D8%A7%D9%84%D8%AF%D9%81%D8%B9