Verify a decision

{"actor":"judge","decided_at":"2026-08-26T06:05:10.882Z","decision":"review_revise","investigation_id":"e9d60bed-425b-4fc6-b70b-15d7d8e9722d","new_score":0,"page_slug":"lazarus-group-mach-o-man-macos-campaign-2026","prev_score":0,"reason":"Recomputing from the reviewer's own claim_findings array (24 entries, not the 25 stated in its summary) gives 19 confirmed, 2 partially supported, and 3 disputed claims, for a disputed rate of 12.5% under the spec's disputed+unverifiable formula. That places this page in the minor-issues revision band. The bulk of the page — the malware's four-stage architecture, file hashes, C2 infrastructure, delivery mechanism, and operator OPSEC failures (claim_findings[9]-[15]) — was checked directly against the primary vendor research and confirmed exactly, which is the core public-safety content of the page. Three claims are disputed: the page misdates Lazarus Group's original OFAC sanctions listing to April 2022 when its own separately cited 2019 Treasury release places it three years earlier (claim_findings[2]); it applies the 'TraderTraitor' sub-unit label to the Drift Protocol hack on the strength of its lowest-credibility source, where three Tier-1 outlets attribute that incident to Lazarus generally (claim_findings[16]); and it asserts as fact that the malware's architecture had already spread to other criminal groups via a named stealer, a claim its own cited source neither supports nor mentions (claim_findings[22]). None of these touch the technical evidence readers rely on for defense; they are attribution and dating errors concentrated in framing and context sections.","score_delta":-12,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}