Modern allocators use mmap(2).
They do? Quite interesting. Tho it shouldn't really change the underlying mechanism; map only pages the process has touched.
May add, if you mmap(2) a memory segment (even a very large one, say 1Tb), nothing happens with regard to page mapping. It is not uncommon to see java tomcat processes allocating north of 80 Gb. But only a small percentage of these is actually used.
At the lower syscall level you move the BRK address, which is the highest memory address you're allowed to use. By default this is just after the statically initialized memory.
malloc() is just a library that manages this memory for you.
Linux has no idea if you will use the memory you just allocated, usually this happens dynamically; when you access a memory region for the first time, it is allocated in memory for real.