PUBLIC-SAFE RUN REPORT
CyberDakait — Multi-Family Android Banking Fraud Cluster (India) — Mobile Fraud Intelligence (MFI)
النتائج المتحققة
لا يوجد
التناقضات والقيود
- UNKNOWN: Group-IB documented CyberDakait as an analytical cluster targeting Indian financial services with seven technically distinct Android Trojan families, at least 17,960 compromised devices across two telemetry vectors, 7,611,443 intercepted SMS messages, 11 banks and 2 government programs impersonated, and malware-assisted banking fraud using social-engineering delivery plus SMS/OTP, call-forwarding and credential/card-data theft.
- حد الدليل: One codebase, conclusively one operator, Jordan/MENA activity, SIM/eSIM, NFC relay, app cloning or identity with Jordan wallet cases.
- UNKNOWN: CYFIRMA independently documented GhostGrab as Android banking/data-stealing and cryptomining malware using Firebase with SMS/OTP theft, call-forwarding capability and banking/KYC phishing, supporting pre-2026 family continuity.
- حد الدليل: The 2026 CyberDakait cluster attribution, 17,960-device denominator, common operator or Jordan/MENA activity.
- UNKNOWN: Cyble independently documented GhostBat using fake RTO/mParivahan themes, GitHub-hosted APK delivery, a fake-update flow, Telegram/Firebase telemetry, UPI/banking credential theft and SMS/OTP collection.
- حد الدليل: The full 2026 cluster, all seven families, common operator, combined victim denominator or Jordan/MENA targeting.
المتابعة المفتوحة
- OPEN [HIGH]: CLUSTER_OPERATOR_IDENTITY — Definitive common-operator proof across all seven CyberDakait families remains missing.
- OPEN [HIGH]: JORDAN_MENA_PROJECTION — No direct Jordan/MENA victim telemetry, bank/provider logs, local IOC hits, transaction authorization-path evidence or authority attribution ties CyberDakait to the region.