AI Weekly Malaysia

OX Security researchers identified 101 npm packages that abuse the open-source 'Baileys' WhatsApp library to silently add victims' WhatsApp accounts to attacker-controlled groups and channels, a campaign dubbed PhantomSub. The packages have been downloaded 490,000 times in total, with 116,000 of those downloads in the last 30 days, and split into three variants: 19 fetch channel IDs from GitHub at runtime, 60 hardcode them in cleartext, and 14 embed them encoded/obfuscated. The write-up follows earlier August 2026 SafeDep findings on malicious Baileys forks and a September Xygeni disclosure about '@dappaoffc/baileys-mod'; one of the groups is assessed to be based in Indonesia and advertises mobile-game and app accounts including Mobile Legends: Bang Bang and TikTok.

Why: If you build or self-host a WhatsApp bot, the practical risk is not just a bad dependency: an already-authenticated Baileys session can be made to follow or join channels, and SafeDep's earlier finding also showed ad URLs being injected into every image and video the bot sends. Check your lockfile for any Baileys fork under a random scope or a name like 'ourin-baileys', 'noxleyss', or '@nexustechpro/baileys', and if one is present, remove it, rotate/re-link the WhatsApp session, and re-audit anything the bot posted. The 116,000 downloads in the last 30 days means these packages are still live and being pulled now, so this is a today check, not a backlog item.

Aon's 2026 Salary Increase and Turnover Study, released Sept 23 and covering 1,200+ organisations across six Southeast Asian markets including Malaysia, found entry-level pay up 2.5% year-on-year but entry-level headcount down 3.2% from 2025. Singapore's overall wage growth slowed to 4.1% (from 4.3%), the slowest in SEA versus Vietnam's 6.6% and Indonesia's 5.4%, while a separate March survey of Singapore's six autonomous universities put graduate employment within six months at 83.4%, down from 87.1% in 2024. Aon's Rahul Chawla said companies should redesign graduate roles around problem solving, judgment and working with AI rather than cut entry opportunities.

Why: If you hire juniors in Malaysia or Singapore, the cost of a graduate is rising (2.5%) while the number of such roles is shrinking (3.2%) - so the budget conversation is shifting from 'can we afford a grad' to 'what does a grad do that an AI-assisted senior cannot'. The report gives you two concrete levers: Technology roles in Singapore grew 4.2% but also saw 5.7% involuntary turnover (second only to financial services at 8.1%), meaning tech hiring is being churned and reshaped, not frozen. Note the Malaysia-specific numbers are not broken out in this article, so treat it as SEA context rather than a local benchmark.

Peak XV Partners raised the per-company investment ceiling for its Surge seed platform from $3M to $5M, and Surge 12 — its first cohort under the new cap — has 18 startups, with the firm investing more than $50M across the batch, which collectively raised over $90M in seed funding. Managing director Rajan Anandan said the bar to raise a Series A has gone up significantly and that capital-intensive deeptech companies are raising larger seed rounds. Of the 18 startups, only five target the Indian market, more than half are based in India, and the rest target global markets, with founders spanning San Francisco to Sydney.

Why: For founders raising in Southeast Asia, the reference point for seed size has moved: Surge now writes up to $5M per company versus $3M, and the cohort's $90M+ total seed raise shows larger early rounds are normal. Combined with Anandan's point that the Series A bar has risen, the practical decision is to size your seed round against the milestones a Series A now requires rather than against a previous $3M-era default — and to note that 13 of these 18 companies are built in one market but sell globally, so an India-built, globally-sold company is a live template for regional founders.

Cloudflare announced that EuroLLM, covering all 24 official EU languages among 35 total, and Apertus, Switzerland's fully open model trained on more than 1,500 languages, are coming to Workers AI and can be requested today. It also launched workshops for government cyber agencies and critical infrastructure operators, with the first in Singapore in October, and repeated its sovereign-AI pitch around choice, open standards, and avoiding single-company dependency. The post cites Cloudflare's network running in more than 335 cities across 125+ countries, with AI inference GPUs in more than 230 cities.

Why: If you build multilingual AI for SEA users, the concrete next step is to request Workers AI access and benchmark EuroLLM/Apertus on your actual languages and tasks—Cloudflare gives no latency, price, or accuracy data here, so the sovereignty framing alone is not enough to switch. The October Singapore workshop is the nearest regional item for teams working with government cyber agencies or critical infrastructure, but treat this as a Cloudflare product announcement rather than independent evidence.

Truecaller launched Scam Checker, a free web and Android tool that lets anyone paste a suspicious phone number, link, or message to see if it's fraudulent, without installing the app or signing in. It works by expanding shortened URLs and following redirects, then matching them against Truecaller's risk database and community reports from ScamFeed; the name attached to a number still requires signing in to the main Truecaller app. It is live in India first, with stated expansion to Latin America, the Middle East and Africa, and Southeast Asia, and Truecaller cites a 2025 GSMA survey of Indian adults in which 46% of scam victims were approached via messaging apps, 37% via SMS, and 32% via voice calls.

Why: There is no Southeast Asia launch date, so nothing changes for Malaysian builders today beyond a free, no-signup scam lookup you can point users at instead of building your own phone-number reputation check. The more useful signal is the structure: Truecaller keeps the identity data (the name behind a number) behind sign-in and gives away only the scam verdict, which is a concrete example of using a free utility as lead generation for a paid/enterprise fraud product. If you run onboarding, KYC, or marketplace flows in SEA, note that the free tier will not give you caller identity, so you still need your own verification path.

Meta appointed Dhruv Vohra as managing director of its global business group for Southeast Asia, covering Indonesia, Malaysia, the Philippines, Singapore, Thailand and Vietnam, reporting to Asia Pacific VP Benjamin Joe. Vohra joined Meta in 2019 leading e-commerce and digital-native work and later SMB growth across SEA and APAC, and the announcement says his remit centres on helping advertisers and agencies use AI and Meta's apps, plus regional partnerships. The post is a leadership announcement with no product, pricing, API or policy change attached.

Why: Nothing here changes what a builder ships this week — no new ad products, messaging API terms, pricing or Malaysia-specific programme is announced, so there is no decision to make off the back of it. The only thing worth noting is the stated commercial emphasis on AI plus business messaging and live shopping across SEA, which is a signal of where Meta's advertiser-facing push will stay focused in Malaysia and neighbouring markets; treat it as a heads-up, not an action item.