Malaysian government websites hijacked to promote online casinos in ongoing SEO scam
Malaysia’s official web domains, including the Dewan Bahasa dan Pustaka site, have been infiltrated to display hidden links for online gambling, highlighting a persistent cyber-SEO campaign.
Malaysian government portals are again being exploited to push illegal online gambling, the latest case involving the national language agency Dewan Bahasa dan Pustaka (DBP). Freelance reporter Nigel Aw reported that DBP’s main site was injected with hidden casino hyperlinks, a sub-domain was swapped for a gambling page, and Google searches for another DBP sub-domain now lead to a casino site. A state government website shows comparable tampering, while past investigations have uncovered more than 150 government and university sites in Malaysia and Indonesia used for the same purpose.
The campaign, labeled “Tundra” by cybersecurity firm Syntx Sdn Bhd, appears to be run by scam centres in the Southeast Asian Golden Triangle and uses code elements linked to China. The operation, described as SEO “poisoning,” has been ongoing since at least August 2023, with some of the DBP modifications already fixed but others still active. Authorities from the Communications Ministry, Digital Ministry and the National Cybersecurity Agency have been contacted for a response.
Why it matters
Hijacked government sites can boost illegal gambling traffic and expose citizens to cyber risks, undermining trust in public digital services.
In this story
