Spoiled Milk, Repackaged. Cybercrime in Malaysia

Prepared by Finfin Nataly

28 October 2026

What comes to mind when you hear the word ‘cybercrime’? Some people might say hacking; others might say phishing or financial scams, and the list goes on. All of that is true. They are all part of cybercrime. However, the dictionary defines cybercrime as criminal activity carried out using computers to illegally access, transmit, or manipulate data[1]. In other words, traditional crimes such as fraud, extortion, and theft remain, but the tools and presentation have changed [2]. It is the same spoiled milk, just repackaged. Many misconceptions revolve around cybercrime. People often see it as an almost invisible online phenomenon, shaped by notions of anonymity, faceless attackers, and hidden darknet sites[2]. In reality, real people perform cybercrime within criminal communities, making it a real-world concern. Moreover, cybercrime has become increasingly organised and specialised. Much like a business, a cybercrime operation can involve different people performing different roles. One person may oversee an operation, while programmers develop malware, others recruit victims or manage stolen data, and another may handle its sale through online marketplaces[3]. These networks also rely on existing relationships and trusted contacts, with many recruits coming through the personal connections of current workers[2]. Malaysia is not outside this picture. In mid-July 2026, police raided 27 apartments and five bungalows in Forest City, Johor, arresting 335 people linked to two online scam syndicates targeting overseas victims[4]. More recently, Bukit Aman Commercial Crime Investigation Department Director, Datuk Rusdi Mohd Isa, reported that Malaysians lost RM2.97 billion to online scams in 2025[5]. Given this, what has the country done to tackle the problem? Is Malaysia’s response keeping pace? Not a newcomer Cybercrime is not a newcomer. Southeast Asia has experienced cyber-related offences for decades, but the scale and nature of these crimes have changed over time. The COVID-19 pandemic further accelerated this shift alongside the rise of online scams from 2020 onwards. As the pandemic disrupted casino operations in border regions and special economic zones (SEZs), as well as reduced revenue from travel restrictions, more criminal networks, both local and foreign, increasingly turned to cyber fraud and other forms of illegal activity to compensate for these losses[6].

Being part of this wider regional trend, Malaysia has been dealing with cyber-related offences since at least the late 1990s, when the Computer Crimes Act 1997 was introduced as part of its legal framework[7]. By the early 2000s, cybercrime had already become a visible concern. This was marked by the 2002 incident in which hackers attacked the websites of the Malaysian Parliament and Universiti Teknologi MARA, followed by a wave of website defacement incidents targeting local websites in 2004[7]. Since then, Malaysia’s cybercrime landscape has expanded beyond these earlier forms of cyber offences.

While the country has its own local cybercriminal networks, Malaysia has also become a base for foreign cybercriminal groups. These networks have used the country for mostly fraud operation activities such as technical training, coordinating money-mule, and running independent scam operations[2]. Advances in digital technologies, such as artificial intelligence (AI), blockchain, malware, and virtual asset service providers (VASPs), have also made cybercrime more complex. These technologies and services give cybercriminals new ways to scam victims, move money, and finance illegal activities while avoiding detection[6]. In short, innovations supposedly used for good have become a comfortable breeding ground for cybercrime to remain and evolve.

What has been done most recently? Malaysia has taken several measures to handle the growing cybercrime threat, including the establishment of the National Scam Response Centre (NSRC) in 2022 and the Cybercrime Bill 2026. NSRC is an emergency operational centre that coordinates rapid responses to online financial fraud, in which its main role is to provide immediate intervention, help speed up the detection and tracing of stolen funds, and prevent further losses through account blocking and freezing[8]. NSRC brings together the National Anti-Financial Crime Centre (NFCC), Royal Malaysia Police (PDRM), Bank Negara Malaysia (BNM), Malaysian Communications and Multimedia Commission (MCMC), financial institutions, and the telecommunications industry into its efforts[8]. As cyber threats today vastly expand and evolve, the nation needs proper legal frameworks to match the progression. In response, Malaysia updated its cybercrime laws through the Cybercrimes Bill 2026, which was passed by the Dewan Rakyat and Dewan Negara in July 2026. The Bill repeals and replaces the Computer Crimes Act 1997 with a broader legal framework that addresses newer forms of cybercrime, including online fraud, identity theft, ransomware, and the misuse of artificial intelligence[9].

While these measures show Malaysia’s efforts to adapt to the changing nature of cybercrime, keeping pace requires more than establishing new institutions and updating legislation. The effectiveness of the NSRC and Cybercrimes Bill 2026 will depend on how well they are implemented and enforced as criminals continue to adopt new technologies and methods. These measures should therefore be supported by continued investment in technology and enforcement capacity, prevention of recruitment to scam centres, and stronger information sharing between government agencies and the private sector. Moreover, public awareness should remain part of the response, as individuals continue to be common targets of online scams. This could include incorporating cybercrime awareness into the education system, conducting simulation exercises to help businesses identify scam schemes, and running awareness campaigns both online and offline. Furthermore, given how cybercrime often operates across national borders, Malaysia’s response should also involve greater cooperation with other countries in the region, including through the Association of Southeast Asian Nations (ASEAN), particularly for law enforcement coordination and intelligence sharing. Overall, addressing cybercrime is part of maintaining the nation’s stability across social, economic and security dimensions. References

1. Merriam Webster (n.d.) Cybercrime, Merriam Webster, accessed 27 September 2026, https://www.merriam-webster.com/dictionary/cybercrime

2. Lusthaus J (2020) Cybercrime in Southeast Asia: Combatting a local threat locally, ASPI (Australian Strategic Policy Institute), accessed 27 September 2026, https://www.aspi.org.au/report/cybercrime-southeast-asia/

3. Lusthaus J (2018) How does the business of cybercrime work?, CFR (Council on Foreign Relations), accessed 27 September 2026, https://www.cfr.org/articles/how-does-business-cybercrime-work

4. Bernama (2026) Police nab 355 in raid on Forest City scam centres, The Edge Malaysia, accessed 25 September 2026, https://theedgemalaysia.com/node/812306

5. Hilmi H (2026) Malaysians lose RM2.97bil to online scams, New Straits Times, accessed 25 September 2026, https://www.nst.com.my/news/nation/2026/09/1531856/malaysians-lose-rm297bil-online-scams

6. Wu L (2024) Fraud with danger: The rise of cyber scams in Southeast Asia, Fulcrum, accessed 25 September 2026, https://fulcrum.sg/article/aseanfocus/fraud-with-danger-the-rise-of-cyber-scams-in-southeast-asia/

7. Mohamed D (2013) ‘Combating the threats of cybercrimes in Malaysia: The efforts, the cyberlaws and the traditional laws’, Computer Law & Security Review, 29(1): 66-76, doi:10.1016/j.clsr.2012.11.005

8. Pusat Pencegahan Jenayah Kewangan Nasional (n.d.) Pusat Respons Penipuan Kebangsaan (NSRC), Pusat Pencegahan Jenayah Kewangan Nasional, accessed 26 September 2026, https://nfcc.jpm.gov.my/index.php/ms/nsrc

9. Ng HS and Danial MI (2026) Cybercrimes bill 2026: Closing the gaps in Malaysia’s cybercrime legal framework, Rahmat Lim & Partners, accessed 25 September 2026, https://www.rahmatlim.com/perspectives/articles/33326/mykh-cybercrimes-bill-2026-closing-the-gaps-in-malaysia-s-cybercrime-legal-framework