A 26-year-old Malaysian man, who is the boyfriend of another suspect, was arrested Wednesday in the city of Anpang, Selangor State Police Chief Abdul Samah Mat said.
He helped lead police to his girlfriend, Mat said.
She was arrested carrying an Indonesian passport at about 2 a.m. Thursday local time, the Royal Malaysian Police said in a statement.
Indonesia's Ministry of Foreign Affairs confirmed she is a national of the country and is requesting consular access.
Police did not say where she was detained, only that she had been identified on closed circuit TV footage from Kuala Lumpur International Airport, and was alone at the time of her arrest.
The first arrest was made on Wednesday when a woman carrying a Vietnamese travel document was taken into custody by police at the airport. Both women have been remanded in custody for seven days, according to police.
The Vietnamese Ministry of Foreign Affairs did not confirm to CNN whether the woman was a Vietnamese citizen.
"Our Vietnamese relevant authorities are working closely with their Malaysian counterparts to clarify the information," Nguyen Phuong Tra, an official with the ministry, said in an emailed statement to CNN.
Mat later confirmed to CNN that a still image from closed circuit television, which was published in the Malay Mail, showed one of the female suspects in Sepang on Monday.
Speaking to the press Thursday, Malaysian Deputy Prime Minister Ahmad Zahid Hamidi said the North Korean embassy in Malaysia had confirmed Kim Jong Nam's identity. Kim had been traveling with two passports, under the name Kim Chol.
North Korea has requested Kim's body through the embassy and Malaysia would comply once the autopsy was complete, Hamidi said. He added that no next of kin had asked for the body.
When asked about reports alleging North Korea's involvement in Kim's death, Hamidi said it was "only speculation."
How it happened
Kim was about to board a flight to Macau, a Chinese territory, to see his family, when he was killed.
He didn't reveal how South Korea knew this or how Kim had been poisoned.
Kim went to a counter at the Kuala Lumpur airport asking for help, Royal Malaysia Police said.
A Malaysian official told CNN that he was then taken to an airport clinic, which decided to send him to the hospital. He died en route.
Autopsy complete
Many unsubstantiated reports of how Kim was attacked have been circulated since his death, but so far Malaysian police have revealed few details.
An autopsy of Kim's remains was completed on Wednesday evening, according to reports by Malaysian state media, but his cause of death was still unknown on Thursday morning.
A car with a North Korean flag was seen entering the hospital mortuary on Tuesday, prior to the autopsy, but the North Korean Embassy in Malaysia has so far said they have no information about the murder.
Kim's death has not been publicized in North Korea and is unlikely to be, given political sensitivities, according to CNN's Will Ripley, who is in Pyongyang.
Kim's fall from grace
Kim Jong Nam was born in 1971 to former North Korean leader Kim Jong Il's favored mistress Song Hye Rim.
He was the North Korean dictator's eldest son.
Current leader Kim Jong Un was born years later to another mistress, Ko Yong Hui.
He was for a time the most public of all Kim Jong Il's sons but reportedly lost his father's favor after using forged documents to try to visit Tokyo Disneyland in 2001.
The brothers never met due to the North Korean practice of keeping heirs separate but Kim Jong Nam told Japanese author Yoji Gomi that he didn't think his younger sibling was up to leading the country.
After he left North Korea, the elder Kim sibling gained a reputation as an international playboy who was willing to speak openly about his family.
His absence from his father's funeral in 2011 fueled rumors he had been banished from North Korea.
CNN's Kathy Quiano in Jakarta; Sandi Sidhu, Kocha Olarn, KL Chan and Saima Mohsin in Kuala Lumpur; Zahra Ullah in Hong Kong; and Matt Rivers and Bobin Seo in Seoul contributed to this report