Electronic Wallet Balance Theft — Jordan & Palestine
Run date
٢٩/١٠/٢٠٢٦، ٣:٠٠ ص
Confidence
غير مسجل
Research result
PASS
Last verified
غير مسجل
CANONICAL LIFECYCLE
دورة الجولة المحفوظة
لا تُستنتج أي مرحلة. Discovery لا تتغير عن UNKNOWN إلا إذا وُجد Run Event محفوظ لها.
HOT_START01
UNKNOWN
01 · OVERVIEW
الملخص والسياق
النتيجة، سبب الاختيار، Delta والهوية التشغيلية كما تم حفظها في Run وTopic.
فتح / طي
نتيجة الجولة
لا يتم رفع مستوى النتيجة أو الثقة عن القيمة المحفوظة.
What ran?
DOMAIN_DEEP_DIVE
Deepen MFI with fresh Jordan identity/account-fraud signals, 2026 financial-identity controls and emerging Android fraud techniques without collapsing social engineering, malware, app cloning or NFC relay into one mechanism.
Research result
ناجح · PASSناجح · PASS
02 · EVIDENCE
الأدلة وحدود الإثبات
كل Evidence مرتبطة بالجولة مع verification state والمصدر وما تثبته وما لا تثبته.
13 Evidenceفتح / طي
MFI-E-0046
Q1 2026 reporting recorded 27 official-impersonation sites/social pages and 113 incidents involving bypass of digital-identity verification and account manipulation.
UNKNOWN
Supports
Supports persistent Jordan phishing/identity abuse and denominator discipline.
03 · AUDIT
التدقيق والتناقضات والمتابعة
Run Events والتناقضات والفجوات والمتابعات؛ الغياب التاريخي يبقى غيابًا ولا يتحول إلى أحداث مصطنعة.
0 contradictions · 3 openفتح / طي
التناقضات
0 سجل persisted لهذه الجولة.
لا توجد تناقضات مسجلة لهذه الجولة.
الفجوات Topic
open_gaps كما هي في canonical Topic record.
{"Notes":"","Gap ID":"CY-GAP-002","Impact":"Blocks unifying multiple incidents into one campaign.","Status":"OPEN","Gap Type":"FINANCIAL_GRAPH","Priority":"HIGH","Domain ID":"CY-DOM-001","Topic IDs":"CY-TOP-001","Description":"No cross-case beneficiary/session/telecom graph establishing a shared operator or cash-out network.","Last Reviewed":"2026-10-28","Resolution Run":"","Required Evidence / Resolution":"Independent repeated financial/telecom linkage."}
04 · PERSISTENCE
Commit / Readback / Snapshot
حالة الالتزام والـReadback والبصمة والـSnapshot، مع إخفاء مراجع Drive الداخلية حتى حماية Admin.
UNKNOWN readbackفتح / طي
Commit record
لا يوجد Commit Record تاريخي مرتبط بهذه الجولة.
State snapshot
ACRIP-SNAP-0010
Snapshot date
غير مسجل
Memory version
1.8
Readback integrity
05 · RELATIONS
Domain / Topic / العلاقات المحفوظة
العلاقات هنا تأتي فقط من primary identity وrelated_topic_ids وrelated_domain_ids وlatest_run_id المحفوظة.
Added 13 new evidence objects; backfilled MFI-E-0042..0045 into Domain SSOT; added Jordan official impersonation/identity-account metrics, Sanad control changes, payment denominator, DragonDoll, Vwork app cloning, official-store loader counterexamples and NFC-relay taxonomy.
قرار Topic
السياق canonical وليس استنتاجًا من واجهة العرض.
Why this Topic?
RESOLVED
Canonical scope
Electronic-wallet balance theft and takeover in Jordan/Palestine, including social engineering, OTP, SIM/eSIM and cash-out; malware only when evidence-linked.
Current Topic summary
CHANGED/EXPANDED — persistent trusted-authority impersonation and identity/account manipulation signals added; Sanad banking/wallet identity controls verified; fraud-reduction outcome remains unmeasured; unified campaign still not established.
Run token
غير مسجل
Topic type
FRAUD_RESEARCH_TOPIC
Topic resolution
RESOLVED
Source status
CLOSED
Prior memory
محمّلة
Publication decision
DRAFT
Article ID
غير مسجل
Started / Completed
غير مسجل · غير مسجل
Does not prove
Does not measure Android-banker prevalence, consumer-wallet victim count or a single campaign/operator.
Confidence
غير مسجل
Context
Official situational-report summary
SRC-4486819A0D44C0E2NCSC via PetraCY-T1 / Jordan OfficialOfficial situational-report summaryفتح المصدر
MFI-E-0047
PSD renewed its warning after continued complaints about audio/video calls impersonating security officers; obtained personal data were then used to steal accounts or financial balances.
UNKNOWN
Supports
Supports vishing/social-engineering account and balance theft as an active Jordan mechanism.
Does not prove
Does not prove malware infection, one operator or exact financial rail.
Confidence
غير مسجل
Context
Official fraud warning / complaint pattern
SRC-9BED1CBBF527ED54Petra / Cybercrime UnitA / Jordan OfficialOfficial warningفتح المصدر
MFI-E-0048
The Ministry of Digital Economy warned of messages impersonating Sanad and official logos, requesting payments, personal-data updates or parcel tracking and soliciting sensitive/OTP data.
UNKNOWN
Supports
Supports trusted digital-identity brand abuse as a current Jordan fraud lure.
Does not prove
Does not prove compromise of Sanad, malware infection or successful loss in a specific case.
Confidence
غير مسجل
Context
Official fraud warning
SRC-6E06EC77066AD67EMODEE via PetraCY-T1 / Jordan OfficialOfficial fraud warningفتح المصدر
MFI-E-0049
CBJ warned of WhatsApp messages claiming ATM cards were blocked for failure to update customer data and directing users to foreign numbers, with aims including device compromise, financial/data theft or extortion.
Does not prove CBJ breach, malware installation or victim loss.
Confidence
غير مسجل
Context
Official fraud warning
SRC-4BF3AE6D7E6C5CDACentral Bank of JordanCY-T1 / Jordan OfficialOfficial fraud warningفتح المصدر
MFI-E-0050
CBJ adopted Sanad digital identity across banks as an official identity-verification method equivalent to traditional identification for banking services.
UNKNOWN
Supports
Supports a material 2026 shift in Jordan banking identity-verification architecture.
Does not prove
Does not prove fraud reduction or eliminate post-authentication/social-engineering/device risks.
Confidence
غير مسجل
Context
Regulatory / identity-control change
SRC-02C6E37503B6CEC9Central Bank of JordanCY-T1 / Jordan OfficialRegulatory / identity-control changeفتح المصدر
MFI-E-0051
CBJ circular 26/2/7487 dated 2026-05-03 requires linking electronic wallets to the Sanad application.
UNKNOWN
Supports
Supports a wallet identity-binding control change.
Does not prove
Does not prove lower fraud rates or block social engineering, malware, SIM/eSIM abuse or APP scams.
Confidence
غير مسجل
Context
Regulatory / wallet-control change
SRC-02C6E37503B6CEC9Central Bank of JordanCY-T1 / Jordan OfficialRegulatory / identity-control changeفتح المصدر
MFI-E-0052
JoPACC reported 363.84M transactions in 2025 (+62%), 102.04M JoMoPay transactions (+79.7%) and 2.81M mobile-wallet users at year-end 2025.
UNKNOWN
Supports
Provides a digital-payment/wallet adoption denominator for exposure context.
Does not prove
Does not measure fraud incidence, victim count, malware prevalence or fraud rate.
Confidence
غير مسجل
Context
Payments adoption / denominator data
SRC-C11774F2A6B13B10JoPACCCY-T1 / Jordan Payments OfficialPayments adoption / denominator dataفتح المصدر
MFI-E-0053
PT ESC found DragonDoll in a Saudi-targeting campaign masquerading as a critical Chrome update; it abuses Accessibility and collects notifications/SMS and messaging content with Arabic localization among many languages.
UNKNOWN
Supports
Supports continued regional fake-update/Accessibility abuse as a real Android mechanism.
Does not prove
Does not prove Jordan infection, financial theft in every case or common operator with MFI complaints.
Group-IB documented Vwork weaponizing Android Work Profile app cloning for Gigabud; compatible samples targeted Egypt, Morocco, Türkiye and a GCC member state, while confirmed infection in the report was Indonesia.
UNKNOWN
Supports
Supports app-cloning/managed-profile abuse as a distinct banking-malware evasion path with MENA targeting configurations.
Does not prove
Targeting configuration does not prove MENA/Jordan infection.
Confidence
غير مسجل
Context
Primary technical research
SRC-8795E56BB3E9B2DFGroup-IBCY-T2 / Primary Threat ResearchPrimary technical researchفتح المصدر
MFI-E-0055
Kaspersky found malicious loaders directly on Google Play; a trojanized PDF reader dropped Anatsa after showing a fake update request.
UNKNOWN
Supports
Supports fake-update staging even when the initial application came through an official store.
Does not prove
Does not make official stores generally unsafe or prove Jordan activity.
Cleafy documented two unrelated Android NFC-relay families actively used for fraud, combining social engineering, card tapping, PIN harvesting and in some flows SMS/OTP interception.
UNKNOWN
Supports
Supports NFC relay as a distinct operational cash-out mechanism.
Does not prove
Does not establish Jordan/MENA deployment or victimization.
Confidence
غير مسجل
Context
Primary technical research
SRC-66BF47D796306B07CleafyCY-T2 / Primary Threat ResearchPrimary technical researchفتح المصدر
MFI-E-0057
Group-IB documented a commercial Android Ghost Tap ecosystem relaying card communications for remote POS/cash-out; more than 54 APK samples were identified and fraud was observed.
UNKNOWN
Supports
Independently corroborates NFC relay as an operational fraud ecosystem.
Does not prove
Does not establish Jordan/MENA campaigns or linkage to MFI actors.
Confidence
غير مسجل
Context
Primary technical research
SRC-53B98B4FBCB90D1EGroup-IBCY-T2 / Primary Threat ResearchPrimary technical researchفتح المصدر
MFI-E-0058
Kaspersky reported malicious apps on Google Play and the App Store containing SparkCat and 162,275 mobile-banking-Trojan installation packages in Q1 KSN telemetry.
UNKNOWN
Supports
Independently supports the rule that store origin alone is insufficient to close a malicious-chain investigation.
Does not prove
Does not imply official stores are broadly compromised or provide Jordan prevalence.
{"Notes":"Introduced by H29; architecture change verified, effectiveness unknown.","Gap ID":"CY-GAP-006","Impact":"Blocks effectiveness claims about the new identity-control architecture.","Status":"OPEN","Gap Type":"CONTROL_EFFECTIVENESS","Priority":"HIGH","Domain ID":"CY-DOM-001","Topic IDs":"CY-TOP-001,CY-DOM-004","Description":"No measured before/after outcome data establishes whether 2026 Sanad banking identity adoption and wallet linkage reduce account/wallet takeover or merely shift attacker tactics.","Last Reviewed":"2026-10-29","Resolution Run":"ACRIP-MFI-20261029-002","Required Evidence / Resolution":"Normalized pre/post fraud rates; new-device/re-enrollment losses; provider/CBJ control-bypass telemetry."}
{"Notes":"Track as emerging mechanism, not local fact.","Gap ID":"CY-GAP-007","Impact":"Blocks local/regional attribution or prevalence claims for NFC relay.","Status":"OPEN","Gap Type":"NFC_REGIONAL_VALIDATION","Priority":"MEDIUM-HIGH","Domain ID":"CY-DOM-001","Topic IDs":"CY-TOP-001","Description":"No verified Jordan/MENA victim evidence for NFC relay / Ghost Tap was recovered despite rapid global operationalization of the technique.","Last Reviewed":"2026-10-29","Resolution Run":"ACRIP-MFI-20261029-002","Required Evidence / Resolution":"Bank/card-issuer/CERT/IR telemetry; victim APK/C2; NFC/card/POS/ATM evidence in Jordan/MENA."}
{"Notes":"Shared fake-update/OTP/call-forwarding TTPs are insufficient for local attribution.","Gap ID":"CY-GAP-015","Impact":"Blocks local campaign/prevalence/attribution claims while preserving defensive relevance.","Status":"OPEN","Gap Type":"JORDAN_MENA_PROJECTION","Priority":"HIGH","Domain ID":"CY-DOM-001","Topic IDs":"CY-TOP-006,CY-TOP-001,CY-DOM-004","Description":"No direct Jordan/MENA victim telemetry, bank/provider logs, local IOC hits, transaction authorization-path evidence or authority attribution ties CyberDakait to the region.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-MFI-20261101-001","Required Evidence / Resolution":"Jordan/MENA victim artifacts, provider/bank session and transaction logs, matched IOCs, authoritative incident reporting and cash-out evidence."}
{"Notes":"Source-echo searches found Microsoft-origin mirrors/derivatives rather than independent same-chain evidence.","Gap ID":"IAS-GAP-001","Impact":"Blocks attribution, prevalence and broad-campaign claims.","Status":"OPEN","Gap Type":"CAMPAIGN_IDENTITY_SCALE","Priority":"HIGH","Domain ID":"CY-DOM-004","Topic IDs":"CY-TOP-IAS-001,CY-TOP-001","Description":"No independent public incident origin currently corroborates the exact Microsoft help-desk/Quick Assist→AD CS ESC1/ESC8 chain; actor identity, victim denominator and campaign prevalence remain unresolved.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-IAS-20261101-001","Required Evidence / Resolution":"Independent IR/EDR/CERT telemetry linking the same sequence, actor/infrastructure evidence, victim counts or authoritative campaign reporting."}
Follow-ups
كل المتابعات المرتبطة، وليس المفتوحة فقط.
3 مفتوحة
CY-GAP-003
METHOD_TELEMETRY
OPEN
Cybersecurity-specific Method Yield telemetry is not yet empirically calibrated.
Priority MEDIUMCreated ٠٣/١١/٢٠٢٦، ١:١٣ مResolved غير مسجلReason Affects future adaptive method allocation, not truth gates. | Collect per-run unique findings, coverage gain, duplicate/noise and verification success. | Telemetry now includes two production research runs; calibration remains OPEN pending more Runs.
CY-GAP-006
CONTROL_EFFECTIVENESS
OPEN
No measured before/after outcome data establishes whether 2026 Sanad banking identity adoption and wallet linkage reduce account/wallet takeover or merely shift attacker tactics.
Priority HIGHCreated ٠٣/١١/٢٠٢٦، ١:١٣ مResolved غير مسجلReason Blocks effectiveness claims about the new identity-control architecture. | Normalized pre/post fraud rates; new-device/re-enrollment losses; provider/CBJ control-bypass telemetry. | Introduced by H29; architecture change verified, effectiveness unknown.
CY-GAP-007
NFC_REGIONAL_VALIDATION
OPEN
No verified Jordan/MENA victim evidence for NFC relay / Ghost Tap was recovered despite rapid global operationalization of the technique.
Priority MEDIUM-HIGHCreated ٠٣/١١/٢٠٢٦، ١:١٣ مResolved غير مسجلReason Blocks local/regional attribution or prevalence claims for NFC relay. | Bank/card-issuer/CERT/IR telemetry; victim APK/C2; NFC/card/POS/ATM evidence in Jordan/MENA. | Track as emerging mechanism, not local fact.
Run Events timeline
0 حدث persisted. إذا كان العدد صفرًا فلن تُشتق Timeline بديلة.
لا توجد run_events تاريخية لهذه الجولة؛ Lifecycle أعلاه يقرأ حقول Run المحفوظة فقط، مع Discovery = UNKNOWN ما لم يوجد Event محفوظ.