Around 2:46am to 2:52am received sms messages.

The card was just replaced earlier this month because the CVC and expiry date scrapped off.

Most of the purchases were for groceries (tap and pay machine). Towards the third/fourth week only, there were some purchases made on Lazada/Shopee. The Lazada/Shoppee APP and transactions were made on X phone.

OTP is sent to Y phone, registered with the bank.

Its really annoying and I am wandering whether the compromise is X phone, Y phone, Lazada/Shoppee App?

Is there any malware app or app to lock certain apps (like messaging, SMS OTP is sent)?

P/S: called the bank about the unauthorised transaction. card has been blocked and replacement on the way.

I saved my credit card info at a lot platform Lazada, Chrome, Facebook, youtube, Apple, Shopee, Google, TnGo etc but never get such case.
I think nothing related to them as they has heavily regulated payment gateway.

Know your stuff. Did you downloaded any sideloading apps?
.apk? VPN shit? remote app? visit public WIFI constantly?