In an immediate statement released after the incident, MAS said the flight which left Melbourne's Tullamarine Airport at 11.11pm (9.11pm Malaysian time), was forced to turn back due to a disruptive passenger.
"I want to take this opportunity to thank the crew and those very courageous passengers who actually subdued this person, and indeed thank every single passenger for their patience, and you can imagine how traumatic that would have been to go through that experience", Mr Andrews said.
"They are pretty big burly guys and they weren't letting him get away saying something like that", she said.
"We do believe that he suffers from mental illnesses and the investigation is ongoing in relation to that", Langdon said.
One eyewitness told ABC Australia that Marks was also screaming, "I'm going to blow the plane up, I'm going to f***ng blow the plane up", during the ordeal.
The man was taken out of the plane handcuffed by Australian Security Officers, an official said.
"He was agitated, is the best description -100 percent, he was agitated", Leoncelli said.
"I thought the plane was going to go down, I thought the bomb was going to go off, I really did think I was going to die", she said.
"We have to make sure all possibilities are taken into account", Ashton said at a news conference Thursday, "including the possibilities of co-offenders - or if there was an explosive device, the possibility of there being other explosive devices that a sudden removal of the passengers could cause an issue with".
Former AFL player Andrew Leoncelli told radio station 3AW he had "never seen anything like" the device the man carried.
"It had two sort of like antenna stuff coming off it".
Superintendent Tony Langdon said the person, a Sri Lankan national, was in police custody and being interviewed.
Passengers started leaving the plane about 1.30am.
After the plane landed, armed security personnel removed Marks and escorted the other passengers off the aircraft, he said.
In air traffic control audio posted online, a male voice can be heard saying: "We have a passenger trying to enter the cockpit".
Flight 128, An Airbus A330-300 carrying 370 passengers, was 10 minutes into a flight from Melbourne when Marks walked from his economy seat to the cockpit door clutching an electronic device and threatening to blow up the plane.
"I think the worst part was that we were sitting on the aircraft for just under two hours, and we were under the impression that there was still an explosive on the aircraft", she said. He described seeing a man carrying a large black cylindrical object which looked like speaker, which appeared to have an on/off button and a charging port.
8am: Passengers were still being held inside the airport at a gate lounge.