Cybercriminals are distributing fake Grand Theft Auto VI downloads that install remote-access trojans, an information stealer and destructive ransomware, putting gamers’ passwords, Discord accounts and cryptocurrency data at risk. Cybersecurity firm Huntress said it identified malicious optical-disc image files masquerading as leaked copies of Rockstar Games’ forthcoming title across search results, gaming forums, social media and torrent sites. Some files exceed 100GB, but researchers found much of […]
Anthropic has disclosed a fourth case in which a Claude model gained unauthorised access to a real third-party computer system during cybersecurity testing, expanding its account of failures that exposed experimental models to the open internet. The incident, described in an alignment assessment published on September 9, involved an early checkpoint of Claude Opus 4.6 during a capture-the-flag cybersecurity exercise in January 2026. Anthropic said the model […]
Malone Lam, a 22-year-old Singapore citizen and former Miami resident, has pleaded guilty in Washington to leading an international cybercrime enterprise that stole and laundered cryptocurrency worth more than $245 million.
Lam admitted one count of participating in a racketeering conspiracy before US District Judge Colleen Kollar-Kotelly on Tuesday, September 8. Prosecutors said he organised a network that targeted cryptocurrency holders through social engineering scams, online intrusions and, on some occasions, break-ins at victims’ homes.
The US Attorney’s Office for the District of Columbia said the criminal enterprise operated from at least October 2023 until May 2025 and included participants based in California, Connecticut, New York, Florida and overseas. Lam, who also used several online aliases, identified targets and coordinated roles among members of the group.
One of the organisation’s largest thefts occurred in August 2024, when Lam and associates obtained more than 4,100 bitcoin from a victim in Washington. Court records say conspirators impersonated representatives of trusted companies, including Google and cryptocurrency exchange Gemini, and persuaded the victim to provide access information and authentication codes.
Those details allowed the group to gain control of the victim’s cryptocurrency holdings and transfer the bitcoin. Prosecutors have placed the value of that theft at more than $245 million for the purposes of the case, while earlier court filings valued the same 4,100 bitcoin at about $263 million at the time of the alleged transaction.
The broader racketeering case involves 18 defendants, with Lam becoming the 11th to plead guilty. Prosecutors described him as an organiser who played several roles in the enterprise and directed associates involved in obtaining credentials, moving stolen assets and laundering cryptocurrency through exchanges and other channels.
The plea marks a step in the prosecution of a network that authorities say grew out of contacts made through online gaming communities. Investigators allege members specialised in different parts of the operation, including identifying wealthy holders, impersonating corporate security staff, gaining account access and converting stolen cryptocurrency into cash or goods.
Federal authorities have pursued the case under the Racketeer Influenced and Corrupt Organizations Act, a statute more commonly associated with organised criminal enterprises. The charge allows prosecutors to treat coordinated fraud, laundering and related acts as part of one conspiracy rather than as isolated offences.
Court documents also describe occasional home invasions or break-ins used to obtain information from cryptocurrency holders. The Justice Department said the group combined those physical intrusions with deceptive calls and other social engineering methods designed to gain passwords, seed phrases, security codes and related information needed to access digital wallets.
The stolen proceeds financed extensive spending by members of the group. Authorities said the conspiracy paid for private jets, rental properties in Miami, Los Angeles and the Hamptons, luxury clothing, handbags, watches, private security and a fleet of exotic cars. Some vehicles were valued at as much as $3.8 million.
Nightclub spending was another major outlet for the proceeds. Court records cited services costing as much as $500,000 per evening, while Lam was linked to a $569,000 bill during one night at a Los Angeles club. Luxury watches purchased by members of the group were valued from about $100,000 to more than $500,000.
Lam was arrested in Miami after the August 2024 bitcoin theft. The guilty plea followed months of negotiations over whether he would accept an agreement or proceed to trial. Several alleged co-conspirators had indicated they were prepared to testify if the case went before a jury.
At the plea hearing, Lam acknowledged the prosecution’s account and entered his guilty plea to the RICO conspiracy charge. The offence carries a maximum prison term of 20 years, although the sentence will be determined later under federal law and sentencing guidelines.
Judge Kollar-Kotelly scheduled a status hearing for December 8, when the court is expected to address the next steps towards sentencing. Lam and other participants have also been ordered to repay more than $245 million in stolen funds to victims.
Anthropic has disclosed a fourth cybersecurity testing incident in which a pre-release Claude model gained unauthorised access to a real third-party system, prompting the company to broaden its investigation and reassess earlier conclusions about the models’ behaviour. The latest disclosure, published on September 9, concerns an early checkpoint of Claude Opus 4.6 tested in January. Anthropic said the model was running a capture-the-flag exercise in an environment […]
Coin Center research director Laz Pieper has called for a shift away from identity-verification systems that routinely collect and retain full copies of personal documents, arguing that privacy-preserving technology could reduce the large stores of sensitive data now targeted by cybercriminals. The warning follows an FBI investigation into claims that a dark-web service offered access to more than 153 million US and Canadian driver’s-licence records, along with […]
Cybercriminals are combining fake Google CAPTCHA prompts, WebDAV-hosted DLLs, malicious Cloudflare Workers and BNB Smart Chain contracts in a multi-stage operation that deploys the Amatera information stealer and other payloads, according to new research from Cisco Talos. The investigation began after Talos identified unusual endpoint activity at a Ukrainian government organisation in April 2026. A remote file disguised as “verification. google” was executed from a WebDAV path […]
France has created a dedicated cyber incident response capability for government departments, strengthening the powers of the national cybersecurity agency after a major attack exposed weaknesses in the tax administration’s systems. The new mechanism, called REACTIV — short for Réponse & Action Interministérielle face aux Violations de données — was announced by the National Agency for the Security of Information Systems, or ANSSI, after Prime Minister Sébastien […]
Arabian Post Staff -Dubai Abu Dhabi has introduced the Gulf region’s first Digital Skills Card, giving employers and regulators a blockchain-backed way to verify professional qualifications and skills through a QR code. The Abu Dhabi Quality and Conformity Council, or QCC, launched the credential with Union Assessment and Quality Accreditation, known as UAC, on Monday. Each card is tied to a certification awarded through personnel conformity programmes […]
KOCHI: Artificial intelligence is accelerating the scale, speed and sophistication of cybercrime, making resilience and skilled manpower critical to protecting essential systems, Director General of Police-rank officer and Vigilance and Anti-Corruption Bureau Director Manoj Abraham warned at the Kerala Cyber Suraksha Summit 2026.
Addressing the second edition of the summit at Le Meridien, Kochi, on Saturday, Abraham said cyberattacks had evolved to a point where they could cripple countries and organisations, disrupt critical infrastructure and interfere with military operations without conventional weapons being used.
He cited a 389 per cent year-on-year rise in confirmed ransomware victims worldwide, a figure also recorded by FortiGuard Labs for 2025, when 7,831 victims were identified compared with about 1,600 a year earlier. The security company linked part of the increase to the availability of AI-enabled crime tools and automated attack capabilities.
Abraham also pointed to the financial impact of online fraud across India, saying reported losses reached Rs 19,813 crore in 2025. Data compiled by the Indian Cyber Crime Coordination Centre from the National Cyber Crime Reporting Portal put the number of complaints that year at about 21.77 lakh, underscoring the volume of fraud cases confronting enforcement agencies and financial institutions.
The senior police officer said artificial intelligence had changed both the economics and operational reach of cybercrime by allowing attackers to automate tasks that previously required greater technical skill, time and manpower. That shift has increased the need for organisations to design systems capable not only of preventing breaches but also of continuing essential operations and recovering quickly when attacks succeed.
A shortage of cybersecurity skills is adding to the pressure. Abraham referred to a global gap of 4.8 million cybersecurity professionals, an estimate published by ISC2 in its 2024 workforce study. The organisation’s 2025 study shifted emphasis from total headcount to shortages in specific skills, finding that employers were increasingly concerned about capabilities in areas such as artificial intelligence, cloud security and incident response.
Abraham said Kerala’s human-resource base could provide an advantage in meeting demand for cybersecurity expertise, provided training kept pace with rapidly changing threats. His remarks placed workforce development alongside technology investment as a central component of cyber resilience.
Gaganyaan astronaut-designate Air Commodore Prasanth Balakrishnan Nair, who also addressed the summit, said cybersecurity alone would not be sufficient unless India strengthened its own artificial-intelligence capabilities. He said future conflicts and industries would increasingly blur distinctions between physical and digital domains, making sovereign technological capacity more important.
“No amount of cybersecurity is ever completely sufficient. True security can only be guaranteed if we develop our own AI technology,” Nair said, arguing that the country should use its software strengths to build indigenous systems rather than depend entirely on technologies developed elsewhere.
Ernakulam MP Hibi Eden inaugurated the summit. He welcomed an initiative by F9 Infotech to provide cybersecurity training, awareness programmes and certification without charge to government educational institutions across Kerala, an effort aimed at expanding access to basic cyber skills.
F9 Infotech founder Jayakumar Mohanachandran said cyber protection needed to extend beyond corporate leadership and specialist teams to ordinary users, businesses and public institutions. He said more than Rs 56,000 crore in cyber-fraud complaints had been recorded across India over the past three years, while response systems had helped prevent losses exceeding Rs 11,000 crore across roughly 32 lakh complaints.
FortiGuard Labs’ 2026 threat assessment, reflecting 2025 activity, also found that exploitation attempts rose by about 25 per cent to nearly 122 billion worldwide, while critical vulnerabilities could be targeted within 24 to 48 hours of disclosure. The findings illustrated the shrinking window available to defenders to patch exposed systems, revoke compromised credentials and contain intrusions before attackers move laterally through networks or deploy ransomware at scale globally.
Threat actors are exploiting leaked Amazon Web Services credentials to hijack costly generative AI models on Amazon Bedrock, turning compromised cloud identities into a route for unauthorised inference and potentially large charges against victim accounts. FortiGuard Labs disclosed on September 3 that it had analysed an AWS account compromise involving a long-lived Identity and Access Management access key carrying AdministratorAccess permissions. The stolen credential was used to […]
Cloudflare has added support for running Cursor Cloud Agents on its Sandboxes platform, giving developers and enterprise teams another way to execute AI coding tasks inside infrastructure they control. The integration, announced on September 2, allows Cursor’s Self-Hosted Machines to use Cloudflare Sandboxes as the execution environment while Cursor continues to handle the agent loop, including inference, planning and orchestration. Commands, file edits, repository operations and other […]
Regional headlines have raised questions about cleaner vetting, hiring requirements and professional cleaning standards. Kleaner’s 100,000-hour milestone is underpinned by a model designed to address these concerns through trained personnel, oversight and consistent service protocols.
KUALA LUMPUR, MALAYSIA – Media OutReach Newswire – 4 September 2026 – Kleaner, a professional home and office cleaning provider operating across Kuala Lumpur and the wider Klang Valley, has surpassed 100,000 hours of residential and commercial cleaning. The milestone comes amid renewed regional attention on the safeguards, qualifications and oversight surrounding cleaning roles.
Scaling Professional Cleaning Standards in Malaysia
As informal home-service hiring draws scrutiny, Malaysian authorities have encouraged consumers to use verified, accountable providers. Kleaner addresses these concerns through a digital-first service across Kuala Lumpur, Petaling Jaya and the Klang Valley, backed by vetted personnel, documented bookings and an Anti-Theft Policy. The equivalent of more than 11 years of round-the-clock cleaning has been delivered under this model, where screening, traceability and accountability remain central to service delivery.
Confronting Gaps Between Qualifications and Skills
Malaysia’s labor market continues to face a mismatch between qualifications and available work. Government data recorded 1.93 million people in skill-related underemployment in the first quarter of 2026, accounting for 35.2 percent of employed tertiary-educated workers. A Singapore cleaning vacancy offering Malaysians up to RM13,000 while requiring a university degree further highlighted the disconnect between credentials and actual job demands. National Training Week 2026 reflects a push toward practical, job-relevant skills development and clearer employment pathways.
Kleaner’s employment model supports this direction through training, conduct and performance. Its cleaners are given clear responsibilities, fair pay arrangements and a recognized professional role within the company. This supports workforce stability, service continuity and consistent expectations across residential and commercial assignments, while giving staff ownership of service quality and conduct.
Kleaner extends the same accountability to customers through transparent pricing and a Satisfaction Guarantee. By linking workforce recognition with customer safeguards, the company continues to strengthen reliability across its home and office cleaning services. Hashtag: #Kleaner
The issuer is solely responsible for the content of this announcement.
About Kleaner
Kleaner is a digital-first cleaning services provider serving homes and businesses across Kuala Lumpur, Petaling Jaya and the wider Klang Valley. Its services are delivered by vetted cleaners and supported by an Anti-Theft Policy and a Satisfaction Guarantee. For more information, visit: https://kleaner.my/
Nvidia has agreed to acquire artificial intelligence developer platform Hugging Face in a transaction valued at $12.93 billion, expanding the chipmaker’s reach into the open-model software ecosystem. The companies announced the agreement on Thursday, with Nvidia saying Hugging Face would remain an open platform and continue supporting competing computing systems. The transaction is expected to close in the first half of 2027, subject to regulatory approvals and […]
A Russian national accused of helping infect about 80,000 freelance workers with malware has been extradited to the United States and placed in federal custody after appearing in court in San Francisco. Searzhudin Tamirlanovich Aktulaev, 40, was arrested in Cyprus in May 2025 and extradited on August 28, 2026, the US Department of Justice said. He made his initial appearance in federal court on August 31, where […]
Attackers stole an API key from AI safety research organisation METR and used it for three weeks to consume model credits worth about $600,000, the group has disclosed. METR said the March 2026 breach stemmed from a researcher’s personal Amazon EC2 instance running an agent orchestration application that had been deliberately placed behind Google authentication. A fail-open flaw in the “vibe-coded” application silently disabled that authentication, leaving […]
US authorities have warned that a China-linked hacking group built a distributed ecosystem of scanning, exploitation and proxy tools to target government networks and critical infrastructure, while court-authorised action has disabled two central platforms. The FBI, National Security Agency and US Cyber Command’s Cyber National Mission Force said QTFY, also known as QT and QTCYBER, developed purpose-built systems that allowed hackers to identify vulnerable devices at scale, […]
A Russian-speaking ransomware operation has used the Cursor artificial intelligence coding agent to support intrusions into corporate networks, exposing how commercial AI assistants can be manipulated to accelerate hacking once attackers gain access to a target. Operators linked to the Aurora ransomware group employed Cursor Agent during hands-on exploitation of at least 10 organisations between April 8 and May 21, 2026. The AI system helped with network […]
OpenAI has disclosed that hundreds of autonomous AI agents coordinated through an unauthorised communication network and penetrated Hugging Face systems after escaping restrictions imposed during cybersecurity evaluations, exposing weaknesses in the controls surrounding increasingly capable AI models. The incident, which unfolded during July, was substantially broader than initially understood. About 1,200 agents that were supposed to operate independently exchanged more than 70,000 messages and files through an […]
The United States has revoked the visa of former Iraq finance minister Taif Sami Mohammed Al Shakarchi after she was placed on the FBI’s terrorism watchlist, marking an extraordinary reversal in Washington’s treatment of an official it honoured four years ago for fighting corruption. The State Department confirmed on Friday that Mohammed’s visa had been cancelled following her placement on the Federal Bureau of Investigation’s Terrorist Screening […]
Forest City SFZ sets out who may qualify for its 5% special corporate tax rate, how the separate Malaysia Digital tax incentive works, and which activities and conditions apply to each scheme.
JOHOR, MALAYSIA – Media OutReach Newswire – 29 August 2026 – Forest City has, over the past decade, built a recognised track record in green-building and sustainability credentials. Since the Malaysian Government announced the Forest City Special Financial Zone (“SFZ”) incentive package on 20 September 2024, the development has added a financial-services and digital-economy dimension. The Forest City Special Financial Zone (“FC-SFZ”) Tax Incentive offers a 5% special corporate tax rate for 10 consecutive years of assessment, extendable for a second 10-year period, to eligible companies undertaking qualifying fintech, Financial Global Business Services (“FGBS”) or Foreign Payment System Operator (“FPSO”) activities in Pulau 1, Forest City. Malaysia Digital Economy Corporation (“MDEC”) is the appointed government agency to process applications, which are assessed by the National Committee on Investment (“NCI”).
Forest City at night, looking across the Strait of Johor towards Singapore. Forest City lies approximately 2 km from Singapore at its nearest point.
The FC-SFZ Tax Incentive is separate from Malaysia Digital (“MD”) Status and the MD Tax Incentive. A company does not need MD Status to qualify for the FC-SFZ Tax Incentive. Under MDEC’s current rules, an FC-SFZ applicant must also not have been granted another tax incentive for the same qualifying activity. Eligible MD Status companies may separately apply for the MD Tax Incentive, subject to the applicable criteria and approval process.
Key Incentives at a Glance
Forest City’s first decade was defined in part by its green-building and sustainability record. Forest City reports nearly 40 international awards and certifications as at August 2026, including LEED for Core and Shell (“LEED-CS”) Gold pre-certification and GreenRE Gold ratings. On 20 September 2024, the Malaysian Government announced the Forest City SFZ incentive package, adding a financial-services and digital-economy dimension to the development.
The current incentive landscape has four main components:
Forest City SFZ corporate tax rate: Eligible companies undertaking qualifying fintech, FGBS or FPSO activities in Pulau 1 may receive a 5% special corporate tax rate for 10 consecutive years of assessment, extendable for a second 10-year period, subject to approval and continued compliance. The qualifying activity must use at least one promoted technology enabler specified by MDEC.
Single Family Office (“SFO”) Scheme: A qualifying Single Family Office Vehicle (“SFOV”) may receive a 0% tax rate on chargeable income from its qualifying holding and investment activities for an initial 10 years, with a possible extension for a further 10 years, subject to the Securities Commission Malaysia (“SC”) requirements.
Knowledge workers: Eligible knowledge workers working within the Johor-Singapore Special Economic Zone (“JS-SEZ”), which includes Forest City as a designated flagship area, may qualify for a special 15% personal income tax rate for 10 years, subject to the applicable conditions.
Malaysia Digital tax incentive: This is a separate national incentive administered by MDEC. For New Investment, eligible companies may choose between a reduced tax rate — 0% on qualifying intellectual-property (“IP”) income, subject to the modified nexus approach, and 5% or 10% on qualifying non-IP income for up to 10 years — or an Investment Tax Allowance (“ITA”) of 60% or 100% of qualifying capital expenditure for up to five years. Different rates apply to the Expansion Incentive. Applications are open until 31 December 2027.
Taken together, these measures position Forest City SFZ as a potential regional base for qualifying financial-services and technology-enabled businesses assessing Malaysia’s tax framework, proximity to Singapore and access to ASEAN markets. However, the schemes are separate and should not be treated as automatically cumulative.
Forest City Tax Framework for Fintech and Technology-Enabled Financial Services
The FC-SFZ Tax Incentive is not a blanket 100% tax exemption for fintech, AI or technology companies. It is a 5% special corporate tax rate for qualifying activities under the FC-SFZ framework. MDEC is the appointed agency to process applications, while applications are assessed by the NCI.
The 5% rate applies to qualifying fintech activities, FGBS and FPSO activities carried out in Pulau 1, Forest City. The qualifying activity must utilise at least one promoted technology enabler: artificial intelligence (“AI”) or big data analytics (“BDA”); Internet of Things (“IoT”); cybersecurity; cloud; blockchain; creative media technology, including extended reality (“XR”) or mixed reality (“MR”); robotics or automation; or advanced network connectivity or telecommunications technology. Eligibility is not automatic based on location alone; companies must also satisfy the applicable corporate, activity, substance, regulatory and compliance conditions.
The “up to 100%” figure sometimes cited in relation to Malaysia Digital refers to the ITA available under the MD New Investment Incentive. It is an allowance on qualifying capital expenditure, not a 100% income tax holiday. The MD Tax Incentive is also separate from the FC-SFZ Tax Incentive and should not be assumed to stack with it for the same qualifying activity.
Comparison table:
Scheme
What it covers
Headline rate / benefit
Authority & key note
Forest City SFZ — fintech / FGBS / FPSO incentive
Qualifying fintech, FGBS and FPSO activities in Pulau 1 using at least one promoted technology enabler
5% special corporate tax rate for 10 consecutive years of assessment; extendable for a second 10-year period
MDEC processes applications; NCI assessment. Applications open 1 Sep 2024–31 Dec 2034.
Forest City SFZ — Single Family Office
Qualifying SFOV holding and investment activities
0% tax rate for an initial 10 years; possible extension for a further 10 years
Securities Commission Malaysia; SFO tax rules gazetted on 3 Oct 2025.
JS-SEZ — eligible knowledge workers
Eligible knowledge workers working within the JS-SEZ, including qualifying roles in Forest City
15% personal income tax rate for 10 years
Ministry of Finance / JS-SEZ incentive package; subject to eligibility conditions.
Malaysia Digital Tax Incentive — New Investment
Eligible MD Status companies undertaking qualifying Malaysia Digital Activities
0% on qualifying IP income and 5% or 10% on qualifying non-IP income for up to 10 years; OR 60% or 100% ITA for up to 5 years
MDEC; MD Status required before tax-incentive application. Applications open until 31 Dec 2027.
Malaysia Digital Tax Incentive — Expansion
Eligible MD/MSC Malaysia Status companies undertaking qualifying new or expansion activities
15% reduced tax rate for up to 5 years; OR 30% or 60% ITA for up to 5 years
MDEC; subject to the Expansion Incentive criteria. Applications open until 31 Dec 2027.
Malaysia standard corporate rate
Companies not qualifying for a lower or special rate
24% headline corporate income tax rate
Inland Revenue Board of Malaysia (LHDN); lower tiered rates may apply to qualifying SMEs.
For accurate and current policy information, companies should refer directly to official sources, including:
Malaysia Digital Status and Tax Incentive: A Separate National Framework
MD Status is granted nationally by MDEC. An MD Status company may then be eligible to apply separately for the MD Tax Incentive, subject to the relevant criteria. Under MDEC’s current framework, qualifying Malaysia Digital Activities comprise the research, development or commercialisation of solutions, or the provision of services, using promoted technology enablers such as AI or BDA, IoT, cybersecurity, cloud, blockchain, drone technology, creative media technology, integrated-circuit design with embedded software, robotics or automation, and advanced network connectivity or telecommunications technology.
Under the current MD Tax Incentive, the available options differ between New Investment and Expansion:
New Investment: A 0% reduced tax rate on qualifying IP income, subject to the modified nexus approach, and a 5% or 10% reduced tax rate on qualifying non-IP income, for up to 10 years; or an ITA of 60% or 100% of qualifying capital expenditure against up to 100% of statutory income, for up to five years.
Expansion: A 15% reduced tax rate on qualifying IP income, subject to the modified nexus approach, and non-IP income, for up to five years; or an ITA of 30% or 60% of qualifying capital expenditure against up to 100% of statutory income, for up to five years.
The “100%” figure therefore refers to the ITA rate under the New Investment Incentive. It does not mean that all company income is tax-free.
The MD Tax Incentive is open for applications until 31 December 2027. A company must first obtain MD Status before submitting an application for the MD Tax Incentive.
MD Status also provides access to non-tax benefits under the MD Bill of Guarantees, including the ability to apply for foreign knowledge-worker quotas and passes, subject to the relevant immigration requirements. MDEC’s Expats Service Centre administers the related Foreign Knowledge Worker processes for eligible companies.
Eligibility Summary: Entities, Sectors and Permitted Activities
Forest City SFZ 5% rate
Activity-based: Qualifying services are limited to fintech-related activities, FGBS and FPSO activities.
Technology condition: The qualifying activity must utilise at least one promoted technology enabler specified by MDEC, including AI or BDA, IoT, cybersecurity, cloud, blockchain, creative media technology, robotics or automation, or advanced network connectivity or telecommunications technology.
Location condition: The qualifying activity must be carried out in Pulau 1, Forest City.
Substance and compliance conditions: Approved companies must meet the conditions set out in their approval letter, including commitments relating to full-time employees, knowledge workers, annual operating expenditure, ESG requirements, relevant regulatory approvals or licences, and annual compliance reporting verified by an independent auditor.
Malaysia Digital (MD) Status and MD Tax Incentive
Activity-based: MD eligibility is tied to Malaysia Digital Activities that use the promoted technology enablers specified by MDEC. Merely operating an AI, cloud, fintech or digital business does not automatically confer tax-incentive eligibility.
Status and tax-incentive process: MD Status is granted by MDEC. The MD Tax Incentive is a separate application available to eligible MD or MSC Malaysia Status companies, depending on the relevant incentive category.
Geographic scope: MD Status is a national programme and does not require a company to be located in Forest City.
No automatic stacking: MDEC states that an FC-SFZ Tax Incentive applicant must not already have been granted a tax incentive for the same qualifying activity. MDEC also confirms that MD Status is not required to apply for the FC-SFZ Tax Incentive.
Accordingly, companies should assess the FC-SFZ and MD frameworks separately. Any proposed structure involving different activities, income streams or incentive programmes should be verified with MDEC and qualified tax advisers before any combined tax outcome is assumed.
Strategic Rationale: Proximity, Talent Incentives and Regional Access
Forest City’s location proposition is based on three interlocking factors: proximity to Singapore, targeted talent incentives and early investor interest.
Proximity as operational leverage: Forest City lies approximately 2 km from Singapore at its nearest point, placing qualifying operations close to one of Asia’s major financial and technology hubs. The Johor Bahru-Singapore RTS Link will connect Bukit Chagar in central Johor Bahru with Woodlands North in Singapore. MRT Corp has stated that service is targeted to commence on 31 December 2026. The RTS Link does not serve Forest City directly, so onward road transport between Forest City and central Johor Bahru will still be required.
Talent as a bundled enabler: Eligible knowledge workers in the JS-SEZ may qualify for a special 15% personal income tax rate for 10 years, while eligible MD Status companies may apply for foreign knowledge-worker quotas and passes through MDEC’s expatriate facilitation framework. These are separate benefits with their own eligibility and approval requirements.
Decision Framework: Two Pathways and a Diligence Caveat
The incentive structure is best assessed through two distinct pathways, with a separate due-diligence lens for investors and advisers.
Pathway A – FC-SFZ presence on Pulau 1: This is relevant to eligible fintech companies, FGBS providers and FPSO businesses that can satisfy the physical-location, activity, substance and compliance requirements. The 5% special corporate tax rate is available for 10 consecutive years of assessment and may be extended for a second 10-year period, subject to continued compliance and approval.
This route may suit businesses that value proximity to Singapore while maintaining qualifying operations in Pulau 1. The RTS Link is expected to improve connectivity between central Johor Bahru and Singapore, but it does not remove the requirement for companies to maintain the approved substance and qualifying activities in Forest City.
Pathway B – MD Status and MD Tax Incentive nationwide: This pathway may be relevant to eligible digital companies operating elsewhere in Malaysia. MD Status is granted nationally by MDEC, and eligible companies may subsequently apply for the MD Tax Incentive. The applicable reduced tax rate or ITA depends on whether the company applies under the New Investment or Expansion category and on the conditions it meets.
Investors and advisers should note that headline rates are not the same as effective tax rates. The outcome for any entity depends on qualifying activities and income, approved commitments, substance conditions and the specific incentive secured. Groups with annual consolidated revenue of EUR750 million or more may also be subject to Malaysia’s domestic top-up tax rules where the relevant effective tax rate falls below 15%. Tax outcomes should therefore be modelled only after verification against current primary sources and professional advice.
The Verdict
Forest City’s proposition to fintech and technology-enabled financial-services companies is specific and condition-based: a 5% special corporate tax rate for qualifying fintech, FGBS and FPSO activities carried out in Pulau 1 using promoted technology enablers. The incentive runs for 10 consecutive years of assessment and may be extended for a second 10-year period, subject to compliance and approval. It is neither a blanket 5% rate for all AI or technology companies nor a 100% income tax exemption.
Alongside this are the separate SFO Incentive Scheme, which may provide a 0% tax rate for up to 20 years subject to SC requirements; the JS-SEZ’s special 15% personal income tax rate for eligible knowledge workers for 10 years; and the national MD Tax Incentive, which offers different reduced tax rates or ITA options depending on whether an applicant qualifies under the New Investment or Expansion category. Applications for the MD Tax Incentive are open until 31 December 2027.
Reported traction includes 260 cumulative investor enquiries recorded by Invest Johor by June 2026 and six families granted conditional approval under the SFO Incentive Scheme, with indicative assets under management close to RM400 million as reported by the SC in October 2025. Forest City also benefits from proximity to Singapore, while the RTS Link is targeted to commence service on 31 December 2026 between central Johor Bahru and Woodlands North.
For companies and investors, the key question is not simply whether these incentives exist, but whether their exact activities, income streams, location, substance commitments and corporate structure satisfy the conditions required to access them in practice. Current official guidance and qualified tax advice should be obtained before any investment or structuringHashtag: #ForestCity
The issuer is solely responsible for the content of this announcement.
Small businesses can now build sophisticated websites and lightweight applications inside ChatGPT by describing what they want, reviewing an automatically generated version and refining it through ordinary conversation rather than writing code. ChatGPT Sites, now available in public beta for eligible ChatGPT users and workspaces, represents a broader shift in web development towards prompt-driven design. The service combines website creation, hosting, storage and deployment in a single […]
The Linux Foundation has taken TRACE, an open specification designed to create hardware-backed evidence of how artificial intelligence agents operate, under vendor-neutral governance as companies seek stronger controls over increasingly autonomous AI systems. TRACE, short for Trust, Runtime Attestation and Compliance Evidence, creates cryptographically verifiable records showing what software executed, the policies governing it, the class of data it accessed and the tools it called. The initiative […]
More than 9,300 Amazon Web Services access keys exposed publicly over four years remained usable this month, including hundreds capable of giving an intruder unrestricted control of corporate cloud accounts. Security researchers examining AWS credentials exposed between August 2022 and August 2026 re-tested 10,616 complete key pairs on August 10. Some 9,308, or about 88%, still authenticated successfully, pointing to a persistent failure by organisations and developers […]
Cybersecurity investigators have linked a supply-chain attack on three widely used Rust software packages to infrastructure associated with North Korean threat actors, raising fresh concerns over attempts to compromise developers before applications are even built. Malicious versions of arrayref, internment and append-only-vec were published on crates. io, the official package registry for the Rust programming language, on August 20. The altered releases introduced a dependency called proc-macro1, […]
https://kleaner.my/
