Electronic Wallet Balance Theft — Jordan & Palestine
Run date
٢٩/١٠/٢٠٢٦، ٣:٠٠ ص
Confidence
غير مسجل
Research result
PASS
Last verified
غير مسجل
CANONICAL LIFECYCLE
دورة الجولة المحفوظة
لا تُستنتج أي مرحلة. Discovery لا تتغير عن UNKNOWN إلا إذا وُجد Run Event محفوظ لها.
HOT_START01
UNKNOWN
01 · OVERVIEW
الملخص والسياق
النتيجة، سبب الاختيار، Delta والهوية التشغيلية كما تم حفظها في Run وTopic.
فتح / طي
نتيجة الجولة
لا يتم رفع مستوى النتيجة أو الثقة عن القيمة المحفوظة.
What ran?
TARGETED_EVENT
سرقة الأرصدة من المحافظ الإلكترونية في الأردن وفلسطين
Research result
ناجح · PASSناجح · PASS
02 · EVIDENCE
الأدلة وحدود الإثبات
كل Evidence مرتبطة بالجولة مع verification state والمصدر وما تثبته وما لا تثبته.
4 Evidenceفتح / طي
MFI-E-0042
PMA reported roughly 2 million electronic-wallet owners by mid-2026, including a large unbanked segment; this establishes exposure/adoption scale, not fraud incidence.
UNKNOWN
Supports
Establishes Palestinian e-wallet adoption/exposure scale and prevents treating isolated incidents as market prevalence.
03 · AUDIT
التدقيق والتناقضات والمتابعة
Run Events والتناقضات والفجوات والمتابعات؛ الغياب التاريخي يبقى غيابًا ولا يتحول إلى أحداث مصطنعة.
0 contradictions · 0 openفتح / طي
التناقضات
0 سجل persisted لهذه الجولة.
لا توجد تناقضات مسجلة لهذه الجولة.
الفجوات Topic
open_gaps كما هي في canonical Topic record.
{"Notes":"","Gap ID":"CY-GAP-002","Impact":"Blocks unifying multiple incidents into one campaign.","Status":"OPEN","Gap Type":"FINANCIAL_GRAPH","Priority":"HIGH","Domain ID":"CY-DOM-001","Topic IDs":"CY-TOP-001","Description":"No cross-case beneficiary/session/telecom graph establishing a shared operator or cash-out network.","Last Reviewed":"2026-10-28","Resolution Run":"","Required Evidence / Resolution":"Independent repeated financial/telecom linkage."}
04 · PERSISTENCE
Commit / Readback / Snapshot
حالة الالتزام والـReadback والبصمة والـSnapshot، مع إخفاء مراجع Drive الداخلية حتى حماية Admin.
UNKNOWN readbackفتح / طي
Commit record
لا يوجد Commit Record تاريخي مرتبط بهذه الجولة.
State snapshot
ACRIP-SNAP-0004
Snapshot date
غير مسجل
Memory version
1.2
Readback integrity
05 · RELATIONS
Domain / Topic / العلاقات المحفوظة
العلاقات هنا تأتي فقط من primary identity وrelated_topic_ids وrelated_domain_ids وlatest_run_id المحفوظة.
Expanded Palestine evidence; separated verified Jordan wallet takeover from Palestine wallet-fraud exposure; preserved cross-border link without same-actor attribution.
قرار Topic
السياق canonical وليس استنتاجًا من واجهة العرض.
Why this Topic?
RESOLVED
Canonical scope
Electronic-wallet balance theft and takeover in Jordan/Palestine, including social engineering, OTP, SIM/eSIM and cash-out; malware only when evidence-linked.
Current Topic summary
CHANGED/EXPANDED — persistent trusted-authority impersonation and identity/account manipulation signals added; Sanad banking/wallet identity controls verified; fraud-reduction outcome remains unmeasured; unified campaign still not established.
Run token
غير مسجل
Topic type
FRAUD_RESEARCH_TOPIC
Topic resolution
RESOLVED
Source status
CLOSED
Prior memory
محمّلة
Publication decision
RESEARCH_MORE
Article ID
غير مسجل
Started / Completed
غير مسجل · غير مسجل
Does not prove
Does not measure wallet-fraud victim count, fraud rate, actor identity, or specific attack mechanism.
PalPay wallet registration/operation relies materially on the Palestinian mobile number and OTP, making control of the phone/SIM/OTP path security-relevant.
UNKNOWN
Supports
Supports the technical relevance of mobile-number/OTP compromise to Palestinian wallet account takeover.
Does not prove
Does not prove SIM swap, eSIM abuse, OTP theft, or account takeover occurred in any specific incident.
Confidence
غير مسجل
Context
Provider architecture / FAQ
SRC-96635CAF81A94A3APalPay / MahfazatiCY-T1 / Provider OfficialProvider architecture / FAQفتح المصدر
MFI-E-0044
A June 2026 report attributed to PalPay warned users not to share OTP/QR/passwords and flagged sudden network loss or an unrequested eSIM as a security warning sign.
UNKNOWN
Supports
Supports SIM/eSIM/OTP compromise as a provider-recognized threat path requiring investigation.
Does not prove
Does not prove a SIM/eSIM takeover incident, prevalence, or linkage to Jordanian fraud cells.
Confidence
غير مسجل
Context
Attributed provider warning
SRC-10573D6104ADFE39Felesteen News citing PalPayCY-T4 / Attributed SecondaryAttributed provider warningفتح المصدر
MFI-E-0045
Specialist-media reporting documented Gaza victims targeted through impersonation/fake support or institutional contacts, verification-code capture and subsequent balance loss/transfer in a high-wallet-use environment.
UNKNOWN
Supports
Supports existence of Palestinian wallet-related fraud using impersonation/social engineering and credential/verification-code capture.
Does not prove
Does not establish national prevalence, a single campaign, malware causation, or linkage to the 2024 Jordan wallet cell.
Confidence
غير مسجل
Context
Victim reporting
SRC-62000DA5129390FBQudsNetCY-T4 / Specialist MediaVictim reportingفتح المصدر
{"Notes":"Introduced by H29; architecture change verified, effectiveness unknown.","Gap ID":"CY-GAP-006","Impact":"Blocks effectiveness claims about the new identity-control architecture.","Status":"OPEN","Gap Type":"CONTROL_EFFECTIVENESS","Priority":"HIGH","Domain ID":"CY-DOM-001","Topic IDs":"CY-TOP-001,CY-DOM-004","Description":"No measured before/after outcome data establishes whether 2026 Sanad banking identity adoption and wallet linkage reduce account/wallet takeover or merely shift attacker tactics.","Last Reviewed":"2026-10-29","Resolution Run":"ACRIP-MFI-20261029-002","Required Evidence / Resolution":"Normalized pre/post fraud rates; new-device/re-enrollment losses; provider/CBJ control-bypass telemetry."}
{"Notes":"Track as emerging mechanism, not local fact.","Gap ID":"CY-GAP-007","Impact":"Blocks local/regional attribution or prevalence claims for NFC relay.","Status":"OPEN","Gap Type":"NFC_REGIONAL_VALIDATION","Priority":"MEDIUM-HIGH","Domain ID":"CY-DOM-001","Topic IDs":"CY-TOP-001","Description":"No verified Jordan/MENA victim evidence for NFC relay / Ghost Tap was recovered despite rapid global operationalization of the technique.","Last Reviewed":"2026-10-29","Resolution Run":"ACRIP-MFI-20261029-002","Required Evidence / Resolution":"Bank/card-issuer/CERT/IR telemetry; victim APK/C2; NFC/card/POS/ATM evidence in Jordan/MENA."}
{"Notes":"Shared fake-update/OTP/call-forwarding TTPs are insufficient for local attribution.","Gap ID":"CY-GAP-015","Impact":"Blocks local campaign/prevalence/attribution claims while preserving defensive relevance.","Status":"OPEN","Gap Type":"JORDAN_MENA_PROJECTION","Priority":"HIGH","Domain ID":"CY-DOM-001","Topic IDs":"CY-TOP-006,CY-TOP-001,CY-DOM-004","Description":"No direct Jordan/MENA victim telemetry, bank/provider logs, local IOC hits, transaction authorization-path evidence or authority attribution ties CyberDakait to the region.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-MFI-20261101-001","Required Evidence / Resolution":"Jordan/MENA victim artifacts, provider/bank session and transaction logs, matched IOCs, authoritative incident reporting and cash-out evidence."}
{"Notes":"Source-echo searches found Microsoft-origin mirrors/derivatives rather than independent same-chain evidence.","Gap ID":"IAS-GAP-001","Impact":"Blocks attribution, prevalence and broad-campaign claims.","Status":"OPEN","Gap Type":"CAMPAIGN_IDENTITY_SCALE","Priority":"HIGH","Domain ID":"CY-DOM-004","Topic IDs":"CY-TOP-IAS-001,CY-TOP-001","Description":"No independent public incident origin currently corroborates the exact Microsoft help-desk/Quick Assist→AD CS ESC1/ESC8 chain; actor identity, victim denominator and campaign prevalence remain unresolved.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-IAS-20261101-001","Required Evidence / Resolution":"Independent IR/EDR/CERT telemetry linking the same sequence, actor/infrastructure evidence, victim counts or authoritative campaign reporting."}
Follow-ups
كل المتابعات المرتبطة، وليس المفتوحة فقط.
0 مفتوحة
لا توجد Follow-ups مرتبطة بهذه الجولة.
Run Events timeline
0 حدث persisted. إذا كان العدد صفرًا فلن تُشتق Timeline بديلة.
لا توجد run_events تاريخية لهذه الجولة؛ Lifecycle أعلاه يقرأ حقول Run المحفوظة فقط، مع Discovery = UNKNOWN ما لم يوجد Event محفوظ.
PASS
Scope
TOPIC_RESEARCH_COMMIT
Evidence count
45
Hypothesis count
27
Run count
2
Publication count
1
Wallet-fraud Jordan/Palestine targeted research persisted; 4 new evidence objects; research state unchanged outside Drive.
Canonical persistence state
Commit UNKNOWNReadback UNKNOWNClosure PASS
PASS — Google Drive research package + canonical memory + Hot-Start committed/read back. Run doc: https://docs.google.com/document/d/1V5TBv6e45xqvfXzy7IAeNfHgt7NLqpW2Pm-iRPLZYrk/edit
Drive Run: مرجع داخلي محفوظ ومخفي حتى تفعيل حماية Admin.Domain Store: مرجع داخلي محفوظ ومخفي حتى تفعيل حماية Admin.