Rangers looked to be heading for their first Sky Bet Championship win of the season after Charlie Austin added to Clint Hill's opener.
But Sean Morrison headed home before Malone (pictured) beat goalkeeper Rob Green with a left-footed strike from 25 yards in the 90th minute.
Rangers were leading through Hill's 33rd-minute header from Matt Phillips' left-wing corner when Austin scored a controversial goal 11 minutes into the second half - again following a Phillips corner.
Ben Gladwin flicked on and after Hill appeared to use his arm to nudge the ball towards Austin, the striker was able to bundle home from close range.
However, Cardiff hit back, scoring from a corner six minutes later when Peter Whittingham swung the ball towards the penalty spot and Morrison stooped to head in.
Malone completed the comeback with a powerful strike from near the left-hand edge of the penalty area after collecting Joe Ralls' pass.
Hill's first-half opener came somewhat against the run of play.
Green had produced two near-post saves, stopping shots from Malone and Joe Mason.
Cardiff also threatened when Anthony Pilkington was unable to connect at the far post with Ralls' cross.
But the visitors then failed to deal with Phillips' excellent delivery and Hill showed great determination to get his head to the ball.
Rangers doubled their lead from the resulting corner when Phillips' shot was tipped behind by keeper Simon Moore after taking a deflection off Matt Connolly.
Cardiff protested in vain that the goal should have been ruled out because of a handball - and they also felt Green used his hand rather than chest to cushion the ball when he raced from his line on 76 minutes.
At the other end, Austin, who has been linked with several top-flight clubs this summer, would have scored a third had former QPR man Connolly not cleared his shot off the line after Massimo Luongo pulled the ball back from the right.
Phillips was then thwarted by another save from Moore after finding himself through on goal when James Perch's long ball was headed on by Luongo.
Mason wasted a glorious opportunity to equalise when he managed to escape Nedum Onuoha only to poke the ball tamely at Green.
Jay Emmanuel-Thomas squandered a chance to make it 3-1 when he dragged a shot wide after being put through by fellow substitute Sebastian Polter shortly before Mason levelled.