Malaysian Teenager Allegedly Arrested for Creating and Selling AI-Generated Deepfake Images of Schoolmates and Alumni in Johor

Authorities in Johor, Malaysia reportedly arrested a 16-year-old student who allegedly used AI-enabled tools to generate and sell deepfake images depicting schoolmates and former students. According to police, the images were created from social media photos and distributed online for payment. The alleged activity affected dozens of victims, including minors, some of whom may have been unaware of the misuse.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The suspect used AI to create sexually explicit deepfake images targeting specific schoolmates and alumni for financial gain and targeted humiliation.

Additional risk subdomains

• 1.2 Exposure to toxic content: The incident involved the creation and distribution of sexually explicit, obscene deepfake content on social media platforms.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by a human user who intentionally used a deployed AI tool to generate and distribute non-consensual sexually explicit deepfakes of his peers.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes the use of 'deepfake technology' to generate manipulated images. Under the EU AI Act, AI-generated content such as deepfakes falls under Limited Risk, which requires transparency obligations to notify users that the content is artificially generated or manipulated.

AI system and alleged parties

• AI system: None named
• AI purpose: Deepfake Image Generation; Image Retouching
• Behaviour type: Tool
• Alleged developer: Unknown image generator developers, Unknown deepfake technology developers
• Alleged deployer: Unnamed student from Johor
• Alleged harmed parties: Unnamed students from Johor, students, minors, Epistemic integrity

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Minor
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Minor, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Minor
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Substantial, indirect Substantial

Malicious content

Reported: The report explicitly describes the creation and distribution of obscene, sexually explicit deepfake images of schoolmates and alumni.

Directly caused: The suspect used AI to generate sexually explicit deepfake images of 30 to 40 victims and uploaded them to social media.

Indirectly caused: The generated obscene photos were circulated across multiple social media groups using the school name 'Foon Yew'.

Inferred additional harm: It is likely that these explicit images persist online and may be further shared or archived on other malicious platforms, exposing more users to toxic content.

Civil rights

Reported: The report does not explicitly use the term 'human rights violations' but describes the non-consensual sexualization of minors, which violates their fundamental rights to dignity and privacy.

Directly caused: The non-consensual creation and sale of sexually explicit images of 30 to 40 individuals, including minors as young as 14, violated their personal dignity and rights.

Inferred additional harm: The incident represents a severe violation of the victims' rights to bodily autonomy, privacy, and protection from sexual exploitation.

Psychological

Reported: The report mentions that the Deputy Digital Minister offered emotional support to the victims, implying psychological distress, but does not explicitly detail specific clinical psychological harm.

Indirectly caused: The creation and distribution of non-consensual sexually explicit deepfakes of 30 to 40 students and alumni likely caused significant emotional distress, anxiety, and humiliation to the victims.

Inferred additional harm: It is highly likely that all 30 to 40 victims suffered severe psychological trauma, anxiety, and social distress due to the public circulation of their sexualized likenesses.

Child sexual exploitation and abuse

Reported: The report explicitly describes an incident involving the creation and distribution of sexually explicit images of minors, which constitutes child sexual abuse material (CSAM).

Directly caused: The suspect created and sold sexually explicit deepfake images of schoolmates, including current students as young as 14 years old.

Indirectly caused: The explicit images of minors were circulated in social media groups.

Inferred additional harm: It is highly likely that these CSAM images remain in circulation on private messaging channels or online forums, causing ongoing harm to the underage victims.

People affected

• Occurrences reported: 1
• People reportedly harmed: 40
• People reportedly exposed: 40

Potential causes

Management

• Lack of Platform Moderation: Social media platforms failed to proactively detect the deepfake groups.

Technology

• Deepfake Technology Accessibility: AI tools allowed easy manipulation of photos into explicit images.
• Lack of AI Generation Safeguards: The AI tool used lacked built-in restrictions to prevent generating porn.

Data Inputs

• Unrestricted Social Media Photos: Victims' photos were easily obtained from public social media profiles.

Human Factors

• Malicious Intent of Teenager: The suspect deliberately targeted schoolmates for financial gain.
• Low Awareness of Victims: Victims were unaware their public photos were being manipulated.

Process and Methods

• Social Media Distribution Channels: Using social media groups to distribute and sell the explicit images.

Regulatory Environment

• Inadequate Online Safety Laws: Existing laws struggled to deter the rapid creation of deepfake content.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from reputable news sources provide clear, consistent details about the arrest, the suspect's age, the method of obtaining photos, the number of victims, and the legal charges. The role of AI in generating deepfakes is explicitly stated.
• Ambiguities identified: The specific AI software or platform used by the teenager is not identified.
• Alternative interpretations: None. The facts of the case are straightforward and uncontested.

A localized criminal incident in Malaysia involving a 16-year-old student using AI tools to generate and sell non-consensual sexually explicit deepfakes of peers. While representing a severe violation of individual privacy and child protection, the incident has negligible national security implications and is being managed via standard domestic law enforcement.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Malaysia
• Alleged perpetrator: Individual

Threat characteristics

• Imminence: Long-term. The immediate perpetrator has been arrested, but the underlying threat of consumer-grade AI tools being used for deepfake generation represents an ongoing strategic challenge.
• Autonomy: Human-controlled. The AI tools were directly operated by the human perpetrator to manipulate images, with no autonomous decision-making by the AI.
• Novelty: Established threat. The creation of non-consensual deepfakes using consumer AI tools is an established threat with numerous prior global incidents.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or kinetic assets were targeted or affected in this incident.
• Information security: Negligible. The incident involved localized, non-state creation of deepfakes for personal and financial motives, with no relation to state-level information warfare or intelligence compromise.
• Sovereignty: Negligible. The incident was a local criminal matter involving a minor and did not impact state sovereignty, elections, or core government functions.
• Economic security: Negligible. No critical economic infrastructure, financial systems, or strategic technological assets were targeted or compromised.
• Societal stability: Minor. While the incident represents a severe violation of individual privacy and child protection rights, its impact is localized and managed through standard domestic law enforcement.