It was about 8:20 a.m. on Monday morning and there was a bustle of passengers in the departure hall of Kuala Lumpur airport's budget terminal when the two women moved in on Kim Jong-nam, the estranged half-brother of North Korea's leader.
A few steps away from a Starbucks and a Puffy Buffy Malaysian food stall, one of the women stood in front of their quarry to distract him. Her accomplice approached from behind, pulled a cloth drenched in some chemical from a blue handbag, reached around his head and clamped it onto his face.
That was enough to deliver a deadly poison to the portly 46-year-old relative of North Korean leader Kim Jong-un, according to a senior Malaysian government source and Malaysian police official Fadzil Ahmat, who both spoke to Reuters.
- PHOTOS: Take a look at members of North Korea's ruling family
- Malaysia detains 2 women over killing of half-brother of North Korean leader
- Kim Jong-un's half-brother assassinated by North Korea agents, South alleges
After the attack, Kim Jong-nam approached a help desk and explained that someone seemed to have grabbed or held his face. He said he felt dizzy and was taken to the Menara Medical Clinic, one floor down near the arrivals area.
"He still felt unwell there, so they decided to send him to the hospital, and he died in the ambulance on the way to Putrajaya Hospital," said Ahmat.
Media reports said the two women fled the airport in taxis. The government source declined to be named because of the sensitivity of the case. Malaysian officials have publicly released little about the killing.
Indeed, it was 36 hours after the murder before they acknowledged it had happened, and then only after the news was broken by South Korean media.
Malaysian police said on Wednesday they had arrested a woman with a Vietnamese travel document as she was trying to take a flight from the same terminal.
According to local media, this was the same woman whose image was captured in a grainy airport CCTV image wearing a white shirt with the acronym 'LOL' on it. A second woman, who was holding an Indonesian passport, was also identified from CCTV footage and detained on Thursday. Vietnam has said it is investigating.
Indonesia has confirmed the second arrested woman was an Indonesian national and is seeking consular access to her. A third suspect, apparently a boyfriend of one of the women, has also been taken into custody, Malaysian police said.
"It's like a mystery novel," said a foreign diplomat in Kuala Lumpur who is closely following developments, which have included comments by South Korean officials that Pyongyang agents were behind the killing.
Many key details about the brazen attack on Kim Jong-nam are still unclear, particularly information about the two arrested women and whose orders, if any, they were following. North Korea has made no public comment on the killing, and calls, an email and a fax message to its embassy in Malaysia were unanswered.
A source in Beijing with ties to the North Korean and Chinese governments told Reuters that Pyongyang was not involved and had no motive for killing Kim Jong-nam. The Malaysian police and the government source's accounts of what happened in the departure hall contradicted early media reports that Kim Jong-nam had been poisoned by injection with a needle.
An autopsy began on Wednesday and is still ongoing, a senior police officer said. When asked if he could confirm that a woman with the Vietnamese documents was the one seen wearing the 'LOL' T-shirt, state police chief Abdul Samah Mat said: "We are investigating to confirm that." Local media identified her as the main attacker.
Manhunt for accomplices
The sources said Kim Jong-nam — travelling under the name of Kim Chol — had flown on Feb. 6 from Macau to the Malaysian capital, which he visited often because he had friends there. He was booked on a return flight with the low-cost airline AirAsia on Monday, the day he died.
Police are looking for four foreign men they believe worked with the two women, the government source said. The entire team involved in the attack landed in Malaysia — although it was not clear where from — some days before the attack, checked into a hotel near the airport and monitored their target's movements, the government source said.
Two employees of the help desk Kim Jong-nam approached declined to discuss the incident when asked by Reuters reporters. Several people working at the Starbucks cafe said they had seen nothing unusual that morning, and the medical centre's receptionist said she could not confirm that he had been brought into the clinic.
The government source said the woman whose documents showed the Vietnamese name of Doan Thi Huong told police that the group split up after the incident and had not seen each other since. The woman said she hadn't been aware that she was killing someone, but the source said police doubt that and believe it was a well-planned operation.