AI Weekly Malaysia

Cleafy traced nearly 100 deployments since April 2026 of the RatHat Android banking-trojan console, run as malware-as-a-service where each customer operates a separate copy. The latest console versions — following an earlier one called Fisher and newer builds named BlackCat Remote Control Management and Panda Workshop V5/V6 — feed captured text messages and credentials from fake banking-app overlays to Google's Gemini to estimate each victim's bank balance and sort phones into high-value and mid-value groups; Cleafy found no use of the model to move money, only to decide 'which victims are worth an operator's time.' The console doubles as a build tool: it signs the malicious app, publishes it to Amazon S3 or a web server, and can rebuild it hourly to change the file hash, while the on-device malware abuses Accessibility access to enable wireless debugging, read the ADB pairing code off the screen, and open a shell through Android Debug Bridge.

Why: Two concrete things to act on. First, the on-device chain is Accessibility access → enable wireless debugging → read the pairing code → ADB shell, so if you ship an Android app, that sequence — not generic 'mobile malware' — is what you should test against and consider detecting. Second, hourly rebuilds from the same malware source mean any pipeline relying on file-hash matching to spot known bad apps will miss these; if you use hash-based scanning for sideloaded builds, that gap is now demonstrated at ~100 console deployments. For anyone adding an LLM to a product, the Gemini use here is purely ranking/triage with no write access, which is the low-risk adoption pattern.

MBSB Bank expanded its cross-border transfer feature, Global Easy Transfer (GET), inside the MJourney app and web portal from 12 to 20 foreign currencies, built on Wise Platform, with a per-day transfer limit of RM150,000 and real-time tracking plus upfront cost disclosure showing the exact recipient amount. New corridors added include Vietnam, Canada and the UAE, alongside continued heavy demand on AUD and GBP. MBSB reports GET transaction volume up 250% in 2026 versus 2025, daily active unique users more than doubled, and a repeat transaction rate above 90%, with family support and monthly living expenses the largest transaction category.

Why: This is a bank white-labelling Wise's cross-border rails into a consumer app at a RM150,000/day cap — high enough to cover most Malaysian SMB supplier payments, not just tuition and family remittances. If you currently route payouts or overseas billing through a standalone remittance provider, GET is now a directly comparable option for the 20 listed corridors, and the disclosed 'exact amount recipient receives' means you can benchmark your current provider's all-in cost on the same terms. Note the article gives no fee percentages or FX spreads, so the cost comparison has to be done yourself inside the app before deciding.

Anthropic published a customer announcement that Barclays is expanding its use of Claude across the bank, targeting Claude Code adoption by 50% of its developer population by end of 2026 and a majority of software engineers in 2027. The post also cites Barclays' Colleague Knowledge Assistant, live since 2025 and built on a retrieval-augmented generation architecture over Claude, used by more than 16,000 colleagues supporting over 20 million UK retail customers. No measured productivity, cost, or quality results are given, and the numbers are Barclays' stated targets plus a vendor-published adoption claim.

Why: This is a vendor-published case study, not a measurement, so do not use it as evidence that AI coding tools cut delivery time. What is usable is the target shape: a large regulated bank publicly committing to 50% Claude Code adoption among developers within a year, which is a concrete benchmark to cite if you are arguing for or against an internal rollout, and a signal for founders selling AI tooling into banks or regulated enterprises that procurement conversations now assume governance and RAG-style knowledge assistants, not just model access. Nothing here changes what a Malaysian builder ships this week; there is no pricing, availability, or regional detail.

MIDA and OCBC Malaysia (OCBC Bank Malaysia Bhd plus OCBC Al-Amin Bank Bhd) signed an MoU to attract investment from Asean, China, Korea and Taiwan, with the aim of funnelling it into high-value sectors such as advanced manufacturing and renewable energy under NIMP 2030. The deal covers joint market outreach, investment missions, sharing investor leads and market insights, and business-matching between anchor investors and local enterprises including SMEs, with OCBC offering tailored financing via the wider OCBC Group. It was signed by MIDA CEO Sikh Shamsul Ibrahim Sikh Abdul Majid and OCBC Malaysia CEOs Tan Chor Sen and Syed Abdull Aziz Syed Kechik.

Why: This is a channel announcement, not a programme you can apply to today: the text names no funding amounts, eligibility criteria, application process, or timeline for the SME business-matching or the OCBC financing. If you run a Malaysian SME or startup that wants anchor-investor supply-chain work, the practical move is to ask MIDA or OCBC directly which sectors and which SME criteria this covers before treating it as a pipeline - nothing here tells you whether you qualify.