Malaysian government websites continue to be targeted by campaigns promoting online gambling platforms. The incidents have raised renewed concerns about cybersecurity across public-sector digital services.
The latest reported incident involved Dewan Bahasa dan Pustaka (DBP), Malaysia's national language agency. Investigative journalist Nigel Aw reported finding concealed links to online casino websites across DBP's online infrastructure after visiting it on October 13.
The apparent compromise took several forms. Hidden gambling links were allegedly inserted into the underlying code of DBP's main website, while one subdomain had been replaced by a gambling page.
Another DBP subdomain reportedly displayed a normal website to regular visitors but directed users arriving through Google searches towards gambling content. The technique appeared intended to exploit the authority of Malaysia's gov.my domain to improve gambling websites' search rankings.
Two of the three reported DBP issues had subsequently been addressed, while the search-related problem had not been fully resolved at the time of reporting. A separate state government website was also reportedly affected by a similar compromise.
Cybersecurity company Syntx said gambling sites have been concealed within Malaysian government and university websites since at least August 2023.
The company has identified 83 compromised government and university hosts across 43 organisations, including 34 government agencies and seven universities. Seventeen remained active during its latest check.
Syntx has described the operation as an SEO poisoning campaign and named it "Tundra".
Malaysia's National Cyber Security Agency said it was aware of such threats and coordinates with relevant agencies to verify incidents and support mitigation.
The agency said most SEO poisoning incidents could be addressed relatively quickly, depending on the extent of the compromise. Cases involving suspected criminal activity may also be referred to relevant law enforcement authorities.
More than 65,000 scam and illegal online gambling items remained accessible despite MCMC takedown requests
