TOPIC
CyberDakait analytical cluster and seven distinct Android Trojan families: fraud chain, cluster/family/operator identity boundaries, victim telemetry, defensive implications and whether any direct evidence supports Jordan/MENA projection.
1
3
2
6
2
NEW — 2026 cluster-level telemetry verified from primary research; independent historical GhostBat/GhostGrab family evidence recovered; seven families remain technically distinct; no Jordan/MENA linkage established.
MOBILE_BANKING_FRAUD_RESEARCH_TOPIC
—
—
—
CyberDakait is a useful analytical fraud-cluster label spanning seven technically distinct Android Trojan families; it is not evidence of one codebase or conclusively one operator.
Shared admin/operator artifacts, infrastructure ownership continuity, code provenance and monetization-backend linkage.
CyberDakait is malware-assisted banking fraud with social-engineering delivery and on-device SMS/OTP/call/credential theft; unrelated fraud mechanisms remain separate absent direct evidence.
Per-victim install/session/transaction authorization-path evidence.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
Related Topics
Related Domains
الإجمالي: 3 Evidence
Group-IB documented CyberDakait as an analytical cluster targeting Indian financial services with seven technically distinct Android Trojan families, at least 17,960 compromised devices across two telemetry vectors, 7,611,443 intercepted SMS messages, 11 banks and 2 government programs impersonated, and malware-assisted banking fraud using social-engineering delivery plus SMS/OTP, call-forwarding and credential/card-data theft.
لا يثبت: One codebase, conclusively one operator, Jordan/MENA activity, SIM/eSIM, NFC relay, app cloning or identity with Jordan wallet cases.
فتح Run المصدرCYFIRMA independently documented GhostGrab as Android banking/data-stealing and cryptomining malware using Firebase with SMS/OTP theft, call-forwarding capability and banking/KYC phishing, supporting pre-2026 family continuity.
لا يثبت: The 2026 CyberDakait cluster attribution, 17,960-device denominator, common operator or Jordan/MENA activity.
فتح Run المصدرCyble independently documented GhostBat using fake RTO/mParivahan themes, GitHub-hosted APK delivery, a fake-update flow, Telegram/Firebase telemetry, UPI/banking credential theft and SMS/OTP collection.
لا يثبت: The full 2026 cluster, all seven families, common operator, combined victim denominator or Jordan/MENA targeting.
فتح Run المصدرShared fake-update, OTP-interception and call-forwarding TTPs are defensively relevant to Jordan/MFI but do not establish CyberDakait activity or attribution in Jordan/MENA.
Jordan/MENA victim artifacts, provider logs, IOC matches, transaction path and authoritative local reporting.
MR ROBOT is an operational Android banking-fraud MaaS with observed affiliate/device telemetry and a reusable service/control plane; evidence supports platform operation but not a global victim or monetary-loss denominator.
Independent same-cluster telemetry, infrastructure continuity, affiliate population and provider loss data.
Hidden call forwarding combined with SMS/OTP interception creates a compound verification-bypass path that can divert bank fraud-check calls while capturing transaction-authentication data.
Per-victim call-forward state, OTP timeline, bank callback logs and transaction authorization path.
MR ROBOT is defensively relevant to Jordan/MFI because its mechanics overlap active watch signals, but no Jordan/MENA campaign attribution is established.
Jordan/MENA victim samples, package/signing/C2 matches, telecom call-forward telemetry, bank/provider logs and authoritative reporting.
Definitive common-operator proof across all seven CyberDakait families remains missing.
Shared administrative artifacts, infrastructure ownership continuity, code provenance, operator handles or monetization-backend linkage across families.
No direct Jordan/MENA victim telemetry, bank/provider logs, local IOC hits, transaction authorization-path evidence or authority attribution ties CyberDakait to the region.
Jordan/MENA victim artifacts, provider/bank session and transaction logs, matched IOCs, authoritative incident reporting and cash-out evidence.