Malaysia Cyber ThreatReport 2026

Credential stuffing — the automated injection of username/password pairs harvested from unrelated global data breaches into Malaysian service login portals — represents the highest-volume initial-access technique observed across all sectors in the reporting period. The economics are compelling for attackers: breach databases containing hundreds of millions of credential pairs are freely circulated on cybercriminal forums, and the overhead of running automated login attempts against a target is negligible. Malaysian banking apps, government portals, and e-commerce platforms are systematically targeted. Organisations that have not deployed multi-factor authentication and credential-breach monitoring face a persistent, low-cost intrusion risk that does not require any exploit or zero-day.

Business Email Compromise (BEC) continues to generate disproportionate financial losses relative to its technical sophistication. Attackers compromise or convincingly impersonate a senior executive or trusted supplier's email account, then insert themselves into a payment or procurement workflow to redirect funds. In the Malaysian context, BEC has been observed targeting finance teams during supplier onboarding, trade-finance transactions, and inter-company fund transfers within corporate groups. Detection is difficult because the attack often exploits legitimate email infrastructure — either through a compromised account or a lookalike domain — rather than malware. The human element, combined with time pressure created by urgency framing in the emails, bypasses most technical controls.

Ransomware groups operating with human-operated, double-extortion models have identified Malaysian healthcare and manufacturing as high-yield targets. Initial access is typically obtained through phishing, exposed remote-desktop services, or unpatched VPN appliances. Attackers then conduct reconnaissance, harvest credentials, and move laterally before deploying ransomware across as many systems as possible. The double-extortion model — encrypting data while also exfiltrating it and threatening public release — significantly increases pressure on victims to pay. Malaysian healthcare facilities face the additional complexity that certain clinical systems cannot simply be shut down, creating recovery sequencing challenges. Manufacturing entities face production loss compounding alongside the recovery cost.

Supply-chain attacks pivot from a compromised third-party — an IT integrator, SaaS provider, or managed-service partner — into the primary target's environment using existing, trusted connectivity. This vector is growing rapidly in Malaysia as organisations adopt cloud-hosted applications that grant vendors persistent API access, and as IT outsourcing to smaller providers expands. A compromised MSP with remote-monitoring access to dozens of client environments presents a disproportionate blast radius. Regulated entities under RMiT are required to perform third-party risk assessments, but the depth of technical security evaluation applied to smaller vendors is inconsistent. The Cybersecurity Act 2024 further reinforces the obligation to assess supply-chain risk for NCII-designated entities.

Operational technology environments — SCADA systems, programmable logic controllers, building management systems, and industrial IoT devices — were historically isolated from internet-connected networks by design. That air-gap has eroded progressively as operational efficiency demands and remote-monitoring capabilities have been layered onto legacy OT infrastructure. Malaysian manufacturing, utilities, and port operations have all seen incidents related to internet-exposed OT interfaces, either through direct attacker discovery via industrial-protocol scanning tools, or through lateral movement from a compromised IT network into the OT segment. The consequences of OT compromise are fundamentally different from typical IT incidents: they can include physical damage, production line shutdown, or — in utilities — public safety implications.