MFI-H-004ACTIVE
Some losses are account takeover from another device without full malware on victim phone.
Bank new-device/session logs; phishing/OTP chronology.
جارٍ تحميل البيانات التشغيلية
TOPIC
Electronic-wallet balance theft and takeover in Jordan/Palestine, including social engineering, OTP, SIM/eSIM and cash-out; malware only when evidence-linked.
2
8
5
21
3
CHANGED/EXPANDED — persistent trusted-authority impersonation and identity/account manipulation signals added; Sanad banking/wallet identity controls verified; fraud-reduction outcome remains unmeasured; unified campaign still not established.
FRAUD_RESEARCH_TOPIC
—
—
—
Some losses are account takeover from another device without full malware on victim phone.
Bank new-device/session logs; phishing/OTP chronology.
SIM/eSIM takeover or interception enabled OTP capture.
SIM/eSIM/port-out/replacement logs.
Multiple networks/campaigns converge at mule/transit/cash-out layers.
Cross-victim beneficiary/outflow/KYC graph.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
Related Topics
Related Domains
الإجمالي: 8 Evidence
Wallet takeover via impersonation, 'data update' pretext, OTP capture and re-enrollment is a confirmed Jordanian modus operandi.
لا يثبت: Does not prove Android malware or linkage to 2026 complaints.
Q1 2026 reporting recorded 27 official-impersonation sites/social pages and 113 incidents involving bypass of digital-identity verification and account manipulation.
لا يثبت: Does not measure Android-banker prevalence, consumer-wallet victim count or a single campaign/operator.
فتح Run المصدرPSD renewed its warning after continued complaints about audio/video calls impersonating security officers; obtained personal data were then used to steal accounts or financial balances.
لا يثبت: Does not prove malware infection, one operator or exact financial rail.
فتح Run المصدرThe Ministry of Digital Economy warned of messages impersonating Sanad and official logos, requesting payments, personal-data updates or parcel tracking and soliciting sensitive/OTP data.
لا يثبت: Does not prove compromise of Sanad, malware infection or successful loss in a specific case.
فتح Run المصدرCBJ warned of WhatsApp messages claiming ATM cards were blocked for failure to update customer data and directing users to foreign numbers, with aims including device compromise, financial/data theft or extortion.
لا يثبت: Does not prove CBJ breach, malware installation or victim loss.
فتح Run المصدرCBJ adopted Sanad digital identity across banks as an official identity-verification method equivalent to traditional identification for banking services.
لا يثبت: Does not prove fraud reduction or eliminate post-authentication/social-engineering/device risks.
فتح Run المصدرCBJ circular 26/2/7487 dated 2026-05-03 requires linking electronic wallets to the Sanad application.
لا يثبت: Does not prove lower fraud rates or block social engineering, malware, SIM/eSIM abuse or APP scams.
فتح Run المصدرJoPACC reported 363.84M transactions in 2025 (+62%), 102.04M JoMoPay transactions (+79.7%) and 2.81M mobile-wallet users at year-end 2025.
لا يثبت: Does not measure fraud incidence, victim count, malware prevalence or fraud rate.
فتح Run المصدرSome Jordan losses are vishing/social-engineering account theft with no infected APK.
Per-case contact chronology + bank session/device data.
E-wallet fraud in Jordan includes distinct mechanisms that must not be merged.
Per-incident authorization/path classification.
National incident statistics do not measure Android-banker prevalence or stolen-wallet victim count.
Underlying NCSC taxonomy/denominators if deeper prevalence work is needed.
Cracked/pirated PC software and games are active delivery vectors for credential stealers, loaders and RATs on Windows.
Normalized infection prevalence by distribution channel and independent telemetry.
Piracy/crack prevalence is a principal causal driver of elevated malware/InfoStealer exposure in MENA.
Matched country/cohort piracy prevalence + normalized infection telemetry + delivery-vector attribution.
Trusted-authority and official-brand impersonation remains an active Jordan account/financial-fraud vector independent of whether malware is present.
Per-case contact chronology, URL/number provenance, session/device logs and loss authorization path.
Jordan's 2026 Sanad integration materially changes banking/wallet identity-verification architecture, but its fraud-reduction effect is not yet established.
Pre/post fraud telemetry; new-device/re-enrollment metrics; provider loss-rate data; control-bypass cases.
Official app-store origin is not sufficient evidence that a downstream Android install/update chain is benign.
Per-case package/signing history, dynamic payload chain, store listing provenance and install/update telemetry.
Android Work Profile/app-cloning abuse is a distinct banking-malware evasion technique with MENA target configurations, but Jordan infection is unverified.
Jordan/MENA victim package, managed-profile artifacts, cloned-app inventory, signer/C2 and provider telemetry.
NFC relay / Ghost Tap is a distinct mobile-financial fraud and cash-out mechanism that must not be merged with wallet ATO, classic OTP theft or DTO without evidence.
Regional victim telemetry, issuer fraud classifications, APK/C2 artifacts and POS/ATM cash-out evidence.
CyberDakait is malware-assisted banking fraud with social-engineering delivery and on-device SMS/OTP/call/credential theft; unrelated fraud mechanisms remain separate absent direct evidence.
Per-victim install/session/transaction authorization-path evidence.
Shared fake-update, OTP-interception and call-forwarding TTPs are defensively relevant to Jordan/MFI but do not establish CyberDakait activity or attribution in Jordan/MENA.
Jordan/MENA victim artifacts, provider logs, IOC matches, transaction path and authoritative local reporting.
Support/help-desk impersonation plus user-approved remote access can become a domain-wide identity-compromise path when exploitable AD CS ESC1/ESC8 conditions are present.
Independent same-chain telemetry, prevalence denominator and actor/campaign identity.
Hidden call forwarding combined with SMS/OTP interception creates a compound verification-bypass path that can divert bank fraud-check calls while capturing transaction-authentication data.
Per-victim call-forward state, OTP timeline, bank callback logs and transaction authorization path.
MR ROBOT is defensively relevant to Jordan/MFI because its mechanics overlap active watch signals, but no Jordan/MENA campaign attribution is established.
Jordan/MENA victim samples, package/signing/C2 matches, telecom call-forward telemetry, bank/provider logs and authoritative reporting.
Direct payment/disbursement API invocation using stolen legitimate credentials from trusted infrastructure is a distinct financial-fraud mechanism that can bypass upstream business-process controls when those controls are not bound to the final payout step.
Per-incident application/API logs, credential provenance, payout-sequence records and approved-loan/beneficiary records.
Whitelisted source infrastructure plus valid API credentials is insufficient as a trust signal; payout controls must verify transaction-sequence integrity, sanctioned-record matching, beneficiary novelty/velocity, cumulative limits and near-real-time reconciliation.
Normalized pre/post control telemetry, bank/gateway logs and blocked-vs-successful payout attempts.
The payment-API fraud model is defensively relevant to Jordan/MENA financial institutions, but no direct Jordan/MENA campaign attribution or matched incident evidence was recovered in this Run.
Jordan/MENA bank/fintech incident telemetry, payment-gateway logs, API abuse artifacts, matched infrastructure or authority reporting.
No cross-case beneficiary/session/telecom graph establishing a shared operator or cash-out network.
Independent repeated financial/telecom linkage.
No measured before/after outcome data establishes whether 2026 Sanad banking identity adoption and wallet linkage reduce account/wallet takeover or merely shift attacker tactics.
Normalized pre/post fraud rates; new-device/re-enrollment losses; provider/CBJ control-bypass telemetry.
No verified Jordan/MENA victim evidence for NFC relay / Ghost Tap was recovered despite rapid global operationalization of the technique.
Bank/card-issuer/CERT/IR telemetry; victim APK/C2; NFC/card/POS/ATM evidence in Jordan/MENA.
No direct Jordan/MENA victim telemetry, bank/provider logs, local IOC hits, transaction authorization-path evidence or authority attribution ties CyberDakait to the region.
Jordan/MENA victim artifacts, provider/bank session and transaction logs, matched IOCs, authoritative incident reporting and cash-out evidence.
No independent public incident origin currently corroborates the exact Microsoft help-desk/Quick Assist→AD CS ESC1/ESC8 chain; actor identity, victim denominator and campaign prevalence remain unresolved.
Independent IR/EDR/CERT telemetry linking the same sequence, actor/infrastructure evidence, victim counts or authoritative campaign reporting.
NFC_REGIONAL_VALIDATION