Bahrain ended with six points thanks to Abdulla Yusuf Helal's winner and South Korea finished on five. Jordan, third with four points, also went through as one of the best third-placed teams.
Saudi Arabia, who had already guaranteed a last-16 spot, topped Group F after they were held to a goalless draw by Thailand while Oman failed to advance after a 1-1 draw with Kyrgyzstan.
Oman finished with two points and Indonesia (three points in Group D) advanced for the first time with a better record as a third-placed team along with Syria, Palestine and Jordan.
Indonesia will play Australia and Palestine take on hosts Qatar. Syria face heavyweights Iran.
South Korea will face Saudi Arabia in the last 16 and coach Jurgen Klinsmann said they did not deliberately finish second to avoid a titanic clash with Group D runners-up Japan.
"We didn't want to avoid Japan, it definitely wasn't our plan to concede three goals today. We wanted to go through in first place, that was our goal," Klinsmann told reporters.
"Malaysia played with a lot of heart and you have to give them credit but we should have won this game."
South Korea opened the scoring in the 21st minute when Jeong Woo-Yeong headed home from a corner. The goal was initially not awarded as Malaysia keeper Syihan Hazmi clawed the ball out of the air before VAR confirmed it had crossed the line.
Malaysia equalised six minutes into the second half when they won the ball back high up the pitch before Faisal Halim twisted and turned in the box to score from a tight angle.
Malaysia took the lead 11 minutes later when Arif Aiman was fouled in the box by Seol Young-Woo and awarded a penalty after a VAR check, with the forward stepping up to put it away.
"With VAR decisions, we can sit down and talk about it all day. It's out of our hands and control, the referee made the decisions," South Korea's Son Heung-Min said.
"Obviously you can argue or question the decision, but we have to respect their decision. They have screens to watch it back."
LATE DRAMA
The game had late drama, however, as Lee Kang-In restored parity in the 83rd minute when his free kick into the top corner went in off the woodwork after Hazmi attempted a save, the strike going down as an own goal.
South Korea won a penalty in injury time with another VAR check after the referee deemed Oh Hyeon-Gyu to have been fouled and Son found the bottom corner from the spot.
But with virtually the last kick of the game in the 15th minute of stoppage time, Romel Morales equalised to spark wild celebrations among the Malaysian fans.
"For us, it's a fantastic result. Congratulations to all Malaysian fans, I appreciate the support we had. I'm grateful to all the players for what they've done," Malaysia's South Korean coach Kim Pan-gon said.
Bahrain netted the winner from a counter-attack in the first half when Helal sprinted from the centre circle with just the keeper to beat and pulled the trigger from outside the box to score.
Bahrain will play Japan in the next round while Jordan play Iraq.
PENALTY SAVED
Saudi Arabia had a penalty taken by Abdullah Radif saved in the first half and though they dominated the game, with Thailand failing to have a shot on target, they were held in a result which sent both teams through.
Thailand will take on Uzbekistan in the next round.
Oman began to dream of qualifying for the last 16 when Muhsen Al Ghassani opened the scoring from a corner in a melee inside the six-yard box in the eighth minute.
But their hopes evaporated in the 80th minute when Kyrgyz forward Joel Kojo capitalised on a miscommunication between defender Khalid Al-Braiki and goalkeeper Ibrahim Al-Mukhaini to put the ball into an empty net.
