Cybersec lifelong student | Blue Teamer | Dumbass (still am) Curator for Malaysian OSINT resource toolkit in startme and UNISHKA🇲🇾.
Malaysia
Joined May 2021
- Tweets709
- Following1K
- Followers215
- Likes489
finx retweeted
🇲🇾 🚨 MALAYSIA: LAND PUBLIC TRANSPORT AGENCY (APAD) SYSTEMS ALLEGEDLY BREACHED, EMPLOYEE MYKAD DATA CLAIMED
A threat actor on an underground forum claims to have breached the digital systems and official email of the Malaysian Land Public Transport Agency (APAD), the government agency under the Ministry of Transport that regulates land public transport.
The actor claims to have taken control of APAD servers and extracted government documents, including:
* Employee schedules and personal data, including MyKad (national identity card) numbers
* Insurance documents and internal maintenance records
* Confidential government correspondence on competency development and administrative reforms
* Employee data and contracts with major companies (Toshiba is named)
The actor also claims the systems were "wiped" and threatens to publish the data if unspecified demands are not met. A sample is attached to the post.
The claim has not been independently verified.
⚠️ Analyst Note:
If authentic, MyKad numbers paired with employee records are a strong enabler of identity fraud, SIM-swap and targeted phishing against Malaysian civil servants, and contractor documents could be abused for supply-chain lures. The "breached and wiped" claim is unproven. Unverified threat-actor claim, NOT confirmation of a compromise of APAD systems.
Source: this is for subscribers only. Subscribe: xitter.cf/DailyDarkWeb/creator-s…
#DDW #DarkWeb #Malaysia #DataBreach #Government #Extortion #ThreatIntelligence
finx retweeted
A Malaysian who found #Tuju to be broken upon release decided to make a #navigation app of his own called ‘#Lapan’, and it appears to be more functional.
dsf.my/2026/10/frustrated-tu…
finx retweeted
wrote an article on this if yall wanna read
harithilmi.com/tuju
finx retweeted
Imagine a world where the SSM database was open (like in UK), rather than paywalled (+ pay per record).
And where information on directorship, beneficial ownership, financial position etc were just a query away.
You wouldn't even need to be highly skilled. Even entry level data analysts would be able to instantly query a company and expose their network of cronies, including the dozens of proxy and subcon arrangements.
@anwaribrahim with whatever time you have left, if you were ever serious about being anti-sakau, please instruct that the SSM database be made fully open by law.
Sample from UK: find-and-update.company-info…
The ownership of Prosignal Consortium, the company behind TuJu, has come under scrutiny over its links to political figures and former top government officials.
Malaysiakini found that the company’s website lists Selat Klang assemblyperson Abdul Rashid Asari as an executive director and former IGP Acryl Sani as a non-executive director.
It previously listed Bashah A Aziz and Negeri Sembilan undang Muhammed Abdullah as directors, but their names no longer appear on the website.
🧵1
malaysiakini.com/news/887760…
finx retweeted
🇲🇾 George Town, Malaysia: Once a major trading port along the Strait of Malacca, George Town has a long history of international connections. This map highlights the diplomatic and consular presence in a city shaped by centuries of trade, migration and cultural exchange.
finx retweeted
Good breakdown on the mechanics. One under-discussed local angle: long before Waze, Google Maps or solid commercial Garmin coverage, Malaysia/Singapore already had Malsingmaps.
It grew out of a mid-2003 GPS enthusiasts’ forum. By ~2009 the community was ~45,000 members strong, with volunteer contributors submitting GPS tracks and POIs. They produced fully routable maps covering Peninsular Malaysia, East Malaysia (Sabah/Sarawak), Singapore and Brunei — released in tiles and updated regularly for Garmin (and later Mapking) devices.
It was genuine citizen-contributed local data at a time when commercial maps for the region were incomplete or expensive. The mapping communities (Malsingmaps and the later MalFreeMaps/MySgFreeMaps split) later shrank as Waze and Google Maps took over.
Given that TuJu currently sits on Google’s mapping and POI data as its base (while adding LLM highway-specific layers), there’s a reasonable case that funding/incubating a revival or successor of something like Malsingmaps (or properly backing open local data efforts) could have produced more sovereign base maps than building a new app that still depends on foreign foundations.
The historical volunteer infrastructure and data already existed.
malsingmaps.com/portal/
finx retweeted
Next on the OSINT Collective Oct'26 stage 🎤
Syed Hafidz: "Automate the Boring Stuff, Not the Analysis"
15:00 GMT · Sat 31 Oct
Build a pipeline that collects, normalises, enriches, dedupes and exports OSINT data, and learn which calls should stay with a human.
Free, online, 500 seats ↓
finx retweeted
Do you know who illustrated the comic on calif.io/php2shell?
Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax.
This artist-hacker couple has the best story, stay tuned!
finx retweeted
Is it crime or terrorism? What are M/NVE and TCC? These attacks share a subculture, a pipeline, and a pattern of statement of intent that a crime-only framing can’t explain.
My latest op-ed for @malaymail examines them through an extremism studies lens. malaymail.com/news/what-you-…
finx retweeted
MA-1484.102026: MyCERT Advisory - Critical PHP2Shell Vulnerabilities in PHP Allowing Unauthenticated Remote Code Execution
#php2shell
mycert.org.my/portal/details…
finx retweeted
The school attack in Kuching, Sarawak, earlier today is unfortunately part of the expanding lineage of memetic attacks, driven by misanthropic and nihilistic violent extremism (MNVE) and the true crime community (TCC). gnet-research.org/2025/12/22…
finx retweeted
a library of military theory
drive.google.com/drive/folde…
finx retweeted
🇲🇾 🚨 MALAYSIA: ARMED FORCES PAYROLL SYSTEM ACCESS ALLEGEDLY OFFERED FOR SALE
A threat actor on an underground forum is advertising alleged access to the payroll system of the Malaysian Armed Forces (Angkatan Tentera Malaysia).
* Listing posted Oct 19, 2026, framed as an initial access sale
* No record count or sample data was shown in the post
* Buyers are directed to an off-forum channel for details
The claim has not been independently verified.
⚠️ Analyst Note:
Access to a military payroll system, if authentic, could expose personnel identities, bank details, salary data and unit structures, giving attackers material for targeted phishing, fraud and espionage against service members. Initial access listings are often exaggerated or resold. Unverified threat-actor claim, NOT confirmation of a breach of Malaysian Armed Forces systems.
Source: this is for subscribers only. Subscribe: xitter.cf/DailyDarkWeb/creator-s…
#DDW #DarkWeb #Malaysia #Military #InitialAccess #ThreatIntelligence
finx retweeted
Do you know how to protect your username and real name?
If not, you should take a look on this article.
#Malaysia #OSINT
substack.com/@rntmoc/note/p-…
finx retweeted
Usually when people hear of a “data breach” affecting an alleged organization — they seem to think that it only affects THAT ONE alleged organization.
It’s completely wrong.
There are still contracts and recruitment records that span far beyond one organization.
