Yesha
Senior Member
- Jan 28, 2026
- 183
- 97
A 24-year-old university student has appeared in court in Zimbabwe facing allegations of stealing more than US$1.1 million from CABS through a sophisticated cyberattack.
The accused, Sabelo Malunga, a final-year Computer Science student, allegedly gained unauthorised access to the bank’s computer systems while working as an IT intern between November last year and February 23 this year.
According to the State, Malunga allegedly used a CABS-issued laptop to download SUPREMO, a remote-access application, on January 23 without authorisation.
Prosecutors allege that he concealed the software within system files in an attempt to avoid detection.
The State further alleges that Malunga continued accessing the bank’s systems after his internship had ended, using the malware to bypass internal controls and initiate fraudulent ZIPIT and VISA transactions.
The alleged cyberattack was reportedly discovered on March 27 after VISA flagged two suspicious international ATM transactions.
Although CABS blocked the affected accounts, the bank had reportedly already lost US$210,500.
Investigators later uncovered multiple malware infections on CABS servers. According to the State, investigations identified 1,911 fraudulent ZIPIT transactions valued at approximately US$925,679.
The money was allegedly transferred through various financial platforms and banks, including EcoCash, InnBucks, CBZ and Ecobank accounts.
CABS subsequently engaged South African digital forensics company MWR to investigate the incident and remove the malware from its systems.
The forensic investigation allegedly linked Malunga to the cyberattack.
Prosecutors further allege that the malware was used to bypass authorisation systems, create fictitious transfers and generate fraudulent telegraphic transfers.
The total alleged loss suffered by CABS has been put at US$1,136,179, with the State saying that none of the money had been recovered at the time of the court proceedings.
Malunga is facing a hacking charge and was remanded in custody pending his bail application.
The allegations have not yet been tested in court, and the accused is presumed innocent until proven guilty.
SOURCE: The Herald, Zimbabwe
The accused, Sabelo Malunga, a final-year Computer Science student, allegedly gained unauthorised access to the bank’s computer systems while working as an IT intern between November last year and February 23 this year.
According to the State, Malunga allegedly used a CABS-issued laptop to download SUPREMO, a remote-access application, on January 23 without authorisation.
Prosecutors allege that he concealed the software within system files in an attempt to avoid detection.
The State further alleges that Malunga continued accessing the bank’s systems after his internship had ended, using the malware to bypass internal controls and initiate fraudulent ZIPIT and VISA transactions.
The alleged cyberattack was reportedly discovered on March 27 after VISA flagged two suspicious international ATM transactions.
Although CABS blocked the affected accounts, the bank had reportedly already lost US$210,500.
Investigators later uncovered multiple malware infections on CABS servers. According to the State, investigations identified 1,911 fraudulent ZIPIT transactions valued at approximately US$925,679.
The money was allegedly transferred through various financial platforms and banks, including EcoCash, InnBucks, CBZ and Ecobank accounts.
CABS subsequently engaged South African digital forensics company MWR to investigate the incident and remove the malware from its systems.
The forensic investigation allegedly linked Malunga to the cyberattack.
Prosecutors further allege that the malware was used to bypass authorisation systems, create fictitious transfers and generate fraudulent telegraphic transfers.
The total alleged loss suffered by CABS has been put at US$1,136,179, with the State saying that none of the money had been recovered at the time of the court proceedings.
Malunga is facing a hacking charge and was remanded in custody pending his bail application.
The allegations have not yet been tested in court, and the accused is presumed innocent until proven guilty.
SOURCE: The Herald, Zimbabwe
