When Criminal Law manages cyber false information, too much is focused on combating direct publishing behaviors, but slacking off in the management of malicious forwarding behaviors. And such slacking is contrary to the original intention of dealing with false information, because the nature of cyber malicious information forwarding is deliberately publishing cyber false information. The loosening of attacking on malicious forwarding behaviors reasons in the lack of clear standards for the identification of "malicious forwarding". To solve this problem, we should consider the content forwarded and the motive of the forwarding behavior as factors, to presume whether the perpetrators are "malicious". At the same time, in order to achieve the justice of judicial determination, we should use the only association standard and anti-evidence rule to limit the presumption.