Jail for man who made videos to show viewers how run scams using malware

SINGAPORE – A member of an organised criminal group recorded at least 20 videos teaching viewers how to scam Singaporeans by using malware.

The court heard on Dec 9 that this was the first prosecution of an offender who had taught others how to use malware, or malicious software.

Between June 2023 and June 2024, Malaysian Cheoh Hai Beng, 49, and several other offenders were linked to a scheme in which Android mobile phones belonging to at least 129 victims were remotely accessed after they were installed with versions of a type of malware called Spymax.

Other individuals could “take over” the mobile phones, and unauthorised outgoing transactions totalling nearly $3.2 million were then made from the victims’ bank accounts.

Cheoh, who recorded the videos in the Dominican Republic and Malaysia between February and May 2023, was sentenced to five years and six months’ jail on Dec 9.

He had pleaded guilty to one count each of misusing a computer system and an offence involving organised crime.

He was also fined $3,608 and will have to spend an additional three weeks behind bars if he fails to pay the amount.

Cheoh’s alleged accomplice, Taiwanese Lee Rong Teng, is still at large.

Deputy public prosecutors Hon Yi, Yee Jia Rong and Ashley Chin stated in court documents that the two men became friends in South Korea in 2008 while they were in jail there for undisclosed offences.

Lee later invited Cheoh to visit him and his wife in the Dominican Republic.

Cheoh then travelled from Malaysia to the Caribbean country on March 20, 2022, and stayed at Lee’s home.

In January 2023, Lee told Cheoh that a friend had introduced him to software which allowed its users to “spy on people’s phones”.

He provided Cheoh with several versions of the software and asked him to learn how these functioned.

Cheoh agreed and taught himself how to operate the software to find out about its capabilities.

The DPPs said that this software was a type of highly sophisticated remote access tool known as Spymax malware, designed to be installed in Android mobile phones.

Once installed, the malware could be controlled remotely, allowing third parties to gain unauthorised access and/or cause unauthorised modifications to the contents of the affected devices.

To remain undetected by the owners of the mobile phones, the software masqueraded as legitimate Android apps for innocuous purposes such as online shopping.

The prosecutors added: “A few weeks later, Lee asked Cheoh to record (tutorial) videos to teach viewers how to use the Spymax malware.

“This was so that Lee could use the... videos to attract potential ‘business partners’ and ‘customers’ to whom he could sell the Spymax malware and (videos).”

Cheoh was initially reluctant to record the videos for Lee, the court heard, as he had earlier overheard Lee speaking to one of his “business partners”, a Malaysian man known only as “Wilson”, about using Spymax to run scams.

Lee promised to pay Cheoh for the videos but also threatened to release a video he had recorded of Cheoh demonstrating the use of Spymax should Cheoh not go along with plan.

From February to April 2023, Cheoh used mobile phones which Lee had provided to record the tutorial videos.

After that, Lee would disseminate the videos to his “business partners” and “customers”.

He also uploaded the videos onto various channels on messaging platform Telegram.

On April 11, 2023, Cheoh returned to Malaysia after Lee allowed him leave the Dominican Republic, even though he had not managed to find a replacement for the Malaysiann.

Cheoh was in Malaysia the following month when Lee asked him to record more tutorial videos.

The DPPs said: “As Lee promised Cheoh that this was the last time he would ask Cheoh to record these videos, Cheoh agreed to record the videos for Lee.

“(Cheoh) recorded these... videos from his residence in Penang, Malaysia, using one of the work phones and his son’s mobile phone.”

He later sent the videos to Lee, who arranged for the two laptops and two mobile phones to be collected from Cheoh outside a supermarket in Penang.

For recording the videos, Cheoh received US$700 (S$907) in February 2023 and US$1,000 each for March and April that year.

These were transferred by Lee to Cheoh in USDT cryptocurrency, which Cheoh converted to cash for his personal use.

Other men were later involved in the criminal scheme to use of Spymax for scams.

At least 129 victims in Singapore suffered losses totalling nearly $3.2 million.

On June 12, 2024, officers from the Royal Malaysian Police arrested Cheoh in his Penang home. He was escorted to Singapore two days later.