Malware syndicates across Southeast Asia are deploying fraudulent gambling applications to intercept digital wallet transactions, targeting systems run by Malaysian payment networks Touch ‘n Go and DuitNow. Instead of processing transactions through secure banking rails, malicious overlays draw counterfeit payment interfaces directly over mobile screens to capture personal identification numbers.

The scale of the threat infrastructure emerged when INTERPOL concluded Operation Synergia III in March, taking down 45,000 malicious IP addresses and servers worldwide. Within that total, police in Macau alone uncovered more than 33,000 fraudulent websites operating as fake casino platforms and spoofed portals designed to harvest personal and financial credentials.

Recent security investigations demonstrate how threat groups use localized mobile tools to penetrate devices across the region. In October, cybersecurity firm ThreatFabric documented Hirudo, an Android trojan that triggers a purchase before projecting an interface carrying counterfeit Malaysian bank and wallet branding.

ThreatFabric documented a trojan called Hirudo, which operates by initiating a transaction and generating a transparent graphical overlay across the phone screen. The counterfeit screen replicates the checkout branding of major Malaysian banks and electronic wallet providers, intercepting the user’s personal identification number before presenting a falsified success notification.

The mechanics exploit payment habits developed in regional commerce. Malaysian shoppers expect deposit screens to show Touch ‘n Go or DuitNow interfaces, rather than standard payment cards. In a review of PIN-approved e-wallet casino payments, a Malaysian comparison site that deposited with two local wallets at each operator found Touch ‘n Go accepted at all ten it listed and DuitNow at eight.

Source link