Quick facts
- The message: an SMS from the sender ID "PDRM" about an unpaid parking ticket, sent between 29 and 30 October, with a link to a fake MyBayar PDRM page.
- The bait: a fake RM150 speeding summons on the PLUS Highway, with a penalty table that climbs to RM300 and "court, up to RM2000".
- What it takes: your mobile number, your full card details and a one-time password (OTP).
- The same server was linked to about 40 hostnames for the same phishing panel, including names for Maybank, AmBank, Maxis, Touch 'n Go and SARA aid.
- Already typed in a card? Call your bank to block it, then call the National Scam Response Centre on 997.
Malaysia's national computer emergency response team, MyCERT, published advisory MA-1499.112026 on 6 November describing an SMS wave that reached Malaysian phones on 29 and 30 October. The messages arrived under the alphanumeric sender ID "PDRM".
How the fake summons works
The page is built to show itself to likely Malaysian phone users and hide from scanners. According to MyCERT, a script checks for touch input, a Malaysian time zone and signs of automation. Anything that fails, such as a security scanner on a desktop, is shown a plain "404" error page instead, "which is why desktop scanners saw nothing". As of 30 October, no VirusTotal vendor had flagged either of the two web addresses used.
A phone that passes is shown a fixed summons: number PD2026AES001, RM150, a speeding offence caught by an AES camera on the PLUS Highway, due on 29 October. The SMS talks about a parking ticket while the page shows a speeding fine, because, MyCERT says, the kit reuses the same summons scene whatever the message says. A table of rising penalties adds the pressure to pay now.
The page first asks for a mobile number to "check the summons", then for the card number, expiry date, CVV and the name on the card. MyCERT found the scam panel can mirror the victim's page to the operator in real time, and the page includes an OTP screen the operator triggers. MyCERT's assessment is that the card details and OTP are then used for online card payments, though it notes the fraud transactions themselves were not observed.
One server, many brands
The two web addresses, amcardmy.com and mayu2u.com, were registered on 27 and 28 October. Both point to the same Alibaba Cloud server in Singapore, which DNS records show hosting about 40 hostnames for the same panel. Besides PDRM, those include lures for Maybank, AmBank, Maxis, Touch 'n Go and SARA aid, plus banks and brands in the Philippines, Indonesia and Pakistan.
MyCERT is careful about what it does not know. One operator behind every brand is its "working assessment, not a proven attribution". The number of victims and the total losses are unknown. By 4 November the lure links still pointed to the same server but returned errors, which MyCERT says is consistent with the operator rotating to new links.
We have reported on this kind of impersonation before, from how often Microsoft is faked in brand phishing to Malaysia's place on Google's map of an Android TV box botnet. This time the disguise is a Malaysian government summons-payment portal.
What to do
- MyCERT says PDRM does not send payment links by SMS. Check a summons in the MyBayar PDRM app, or type mybayar.rmp.gov.my into the browser yourself.
- Never enter card details or an OTP on a page you reached from an SMS link, however official it looks.
- If you already did, call your bank to block the card, then report it to the National Scam Response Centre on 997.
- Report a suspicious SMS to MyCERT's Cyber999 service at [email protected].
The same advice covers any summons, bill or delivery SMS that asks for card details, since MyCERT found bank, telco and aid lures on the same infrastructure. MyCERT's 24-hour incident line is +60 19 266 5850.
