The incident took place late Wednesday in the Semporna district of Sabah state, which is on the Malaysian side of Borneo island.
The raid underlines persistent security threats in Sabah, a popular tourist destination and dive spot that is a short boat ride from the southern Philippines, where Muslim militants and kidnap gangs have long found safe haven.
It will likely add to negative sentiment in China over the safety of its citizens in Malaysia, which is still hunting for a jetliner that went missing March 8 with 153 Chinese citizens on board.
Six men armed with pistols raided the Singamata Reef Resort, a midrange resort popular with Chinese tourists, according to a police report sent to the Associated Press by a security official.
It said the Chinese victim was a 28-year-old woman from Shanghai, while the hotel worker was a 40-year-old Philippines national.
A receptionist at the hotel declined to comment, as did police in the district.
A Philippines intelligence official said the attackers were believed to be from the Abu Sayaff group, a militant Muslim group that claims allegiance to al-Qaida and has been implicated in other kidnappings for ransom in the region before.
Last November, suspected Abu Sayyaf militants shot and killed a Taiwanese tourist and kidnapped his wife from a resort in the Semporna area. The women was released a month later in the southern Philippines. Authorities didn't say whether a ransom was paid. Such deals are normally not immediately disclosed to the media, if at all
In 2000, Abu Sayyaf gunmen crossed the porous maritime border with Malaysia in speedboats and snatched 21 European tourists and Malaysian and Filipino workers from Malaysia's Sipadan diving resort and brought them to the southern Philippines, where the captives were later released in exchange for ransom.
Militants in the southern Philippines are holding more than a dozen captives, including two European bird watchers who were seized from Tawi-Tawi, the southernmost Philippines province closest to Sabah, in 2012.
Gomez reported from Manila. Chris Brummitt in Kuala Lumpur also contributed to this report.