Downloading a Mega888 APK is risky. The app isn’t on Google Play or the App Store, it’s sold through agents, and Malaysian police warn that malware in APK files from unknown sources can give scammers your bank details and one-time passwords (OTPs).
It can also land you in court. In 2026, magistrates in Kuching fined a Mega888 player and a 918Kiss player RM2,500 each for gambling online in public places.
This guide explains what these apps are, how fake and tampered APKs work, the warning signs, and what to do if you’ve already installed one. We don’t link to any APK, agent or download page. 21+ only.
What are Mega888, 918Kiss and Pussy888?
Mega888, 918Kiss and Pussy888 are slot-game apps passed around as APK files for Android, with separate install routes for iPhone. You won’t find them on Google Play or the App Store.
Google Play only allows real-money gambling apps that hold a valid gambling licence for each country they are offered in, and Malaysia doesn’t license online casinos. So these apps reach players another way: through agents, chat groups and “download” websites.
Credits are bought from whoever runs your account. In a 918Kiss case heard in Kuching, the court was told that top-ups were points “purchased from the organiser at a rate of RM1 per point”.
Some online casinos also list Mega888, 918Kiss or Pussy888 inside their own lobbies. That changes who you deal with, not the legal position.
Is using Mega888 legal in Malaysia?
No. Online casinos are not licensed in Malaysia, and players as well as operators are prosecuted under the Common Gaming Houses Act 1953.
- 918Kiss, February 2026: a 42-year-old man was fined RM2,500 for online gambling at a café in Kuching, under Section 7(2) of the Act.
- Mega888, October 2026: another Kuching man was fined RM2,500 after police found a Mega888 game on his phone at a café. The same report says using a phone as a gambling machine can be charged under Section 4B(a), with a minimum fine of RM10,000 per machine and up to five years’ jail.
- Raids: police carried out 201 raids on 31 Oct and 1 Nov 2026 under Op Dadu Khas, 108 of them on online gambling, and arrested 282 people.
- Blocking: the Communications Ministry says 1,778 gambling websites were blocked and 457,562 gambling posts taken down between 1 Jan 2025 and 31 May 2026.
Gambling is also prohibited for Muslims under Syariah law. Read our full guide: is online gambling legal in Malaysia?
How fake and tampered APKs steal money
An APK is an Android install file. When you install one from outside Google Play, nobody has checked what it does, and that’s the main route for phone banking malware.
- Remote control and OTP theft. Sepang police warned in October 2025 that once malware from an APK is installed, it “lets scammers access everything, including your bank details and OTP”, and that “your phone can act like a TeamViewer app”.
- Fake betting apps. Security firm Group-IB found fake betting apps promoted through more than 500 ads and 1,377 websites, “often distributed through third-party websites or APK files” (November 2024).
- Gambling apps as cover. Kaspersky found a spy trojan, SparkKitty, hidden in apps posing as gambling and TikTok apps, aimed at users in South-East Asia and China. It steals photos from the phone’s gallery (June 2025).
We couldn’t find a published security analysis of a fake Mega888, 918Kiss or Pussy888 APK. But these apps travel the same way the malware above does: as files passed around by people you can’t verify.
Scams linked to online gambling apps
Malware isn’t the only risk. Police and court reports describe two common traps:
- “Pay to withdraw”. Victims are shown large “winnings”, then told to pay more before they can withdraw. A Penang teacher lost RM604,000 and never received a supposed RM1.8 million (November 2025). A Penang property agent lost RM759,950 over 20 transfers (January 2026).
- Mule accounts. Gambling syndicates need bank accounts to move money. Letting someone use yours is an offence under Sections 424A to 424C of the Penal Code, with up to 10 years’ jail and a fine of up to RM150,000, according to Bukit Aman’s commercial crime department. Penang police froze more than 150 mule accounts linked to online gambling syndicates, involving over RM32 million (May 2025).
Casino games have a built-in house edge, so over time you should expect to lose more than you win. No agent or app changes that.
Warning signs of a fake or tampered APK
Stop if you see any of these:
- An agent sends the file by WhatsApp or Telegram, or a site tells you to turn on Install unknown apps.
- The app asks for Accessibility, SMS or display over other apps permissions. A slot game needs none of them, and security researchers flag all three as signs of banking malware.
- The file name doesn’t match the app you wanted, or it claims to be a system “update”.
- The app installs under a different name from the casino. Three casinos we compare do this on iPhone: 96M’s app installs as “Where2Makan”, Maxim88’s as “HappiKuotasi” and BK8’s as “Cookbyte”. That makes a fake much harder to spot.
- Google Play Protect warns you or blocks the install.
- Your banking app warns about a risky app on your phone, or refuses to open.
- After installing, your phone slows down, shows pop-ups or installs apps you didn’t choose.
What to do if you installed one or lost money
Act fast. The sooner you report it, the better the chance of freezing the money.
- Call 997, the National Scam Response Centre. It runs 24 hours a day, and the government says to call within 24 hours of finding out.
- Call your bank and ask it to freeze your account.
- Clean the phone. Sepang police advise uninstalling all banking apps and formatting (resetting) the phone.
- Lodge a police report at the nearest police station.
- Check before you pay anyone. Search their account number on PDRM’s Semak Mule and check Bank Negara’s Financial Consumer Alert List.
Safer ways to play, if you play at all
The safest choice is not to install gambling APKs at all. If you still want these games, several casinos we compare list Mega888, 918Kiss or Pussy888 in their own lobbies, so you deal with a named site rather than an anonymous agent.
| Casino | Lists in its lobby | Licence check | Note |
|---|---|---|---|
| me88 | Mega888, 918Kiss | Valid on the Anjouan register | Its download page also offers a separate Mega888 app |
| GOD55 | Mega888, 918Kiss, Pussy888 | Valid on the Anjouan register | Separate lobby pages for each |
| 96M | Mega888, 918Kiss | Not verifiable | Its own apps install under another name |
| UWIN33 | Mega888 | Not verifiable | Bonus excludes Mega888 non-slot games |
| Maxim88 | Mega888, 918Kiss | Not verifiable | Calls testing labs “gambling authorities” |
We couldn’t check whether these games run in the browser without an account. Playing through a casino doesn’t make it legal in Malaysia. Compare every casino’s score in our full ranking.
Sources
Checked 2 Nov 2026:
- Sarawak Tribune: 918Kiss player fined RM2,500 (24 Feb 2026)
- The Rakyat Post: Mega888 player fined; Section 4B(a) penalties (7 Oct 2026)
- The Sun: Op Dadu Khas, 201 raids in two days (2 Nov 2026)
- The Star: 1,778 gambling websites blocked since January 2025 (16 Jul 2026)
- Sinar Daily: Sepang police warning on APK malware (28 Oct 2025)
- Group-IB: fake betting apps (28 Nov 2024)
- Kaspersky: SparkKitty trojan (23 Jun 2025)
- Malay Mail: Penang agent loses RM760,000 (3 Jan 2026)
- The Vibes: Penang teacher loses RM604,000 (21 Nov 2025)
- The Vibes: 150 mule accounts frozen in Penang (22 May 2025)
- Bernama: mule account cases and Penal Code penalties (23 Jul 2025)
- MyGOV: NSRC 997 hotline (updated 21 Oct 2026)
- Google Play: real-money gambling app policy
