A 24-year-old Midlands State University (MSU) final-year Computer Science student has appeared in court accused of hacking CABS’ computer systems and allegedly stealing more than US$1.1 million through fraudulent electronic transactions.
According to the National Prosecuting Authority of Zimbabwe (NPAZ), Sabelo Malunga allegedly gained unauthorised access to CABS’ systems and used malware to bypass internal controls and facilitate fraudulent ZIPIT and VISA transactions.
“The accused person, Sabelo Malunga, aged 24 years, a final-year Computer Science student at Midlands State University, is facing a charge of hacking after he allegedly gained unauthorised access to CABS computer systems and stole US$1,136,179,” the NPAZ said.
The prosecution alleges that on January 23, while using a CABS-issued laptop, Malunga downloaded SUPREMO, a remote-access application, without authorisation and concealed it within system files to evade detection.
“On 23 January 2026, whilst using a CABS-issued laptop, the accused allegedly downloaded SUPREMO, a remote-access application, without authorisation and concealed it within system files to avoid detection,” NPAZ said.
The alleged cyberattack was discovered on March 27 after VISA flagged two suspicious international ATM transactions. CABS reportedly blocked the affected accounts but had already suffered a loss of US$210,500.
“Further investigations revealed that 1,911 fraudulent ZIPIT transactions valued at US$925,679 had been processed, with funds allegedly being transferred to EcoCash, InnBucks, CBZ and Ecobank,” the authority said.
CABS subsequently engaged South African digital forensics company MWR to investigate the breach, remove the malware and establish how the bank’s systems had been compromised.
“The forensic investigation allegedly linked Malunga to the cyberattack, with the State alleging that the malware was used to generate fictitious transfers, bypass authorisation systems and create fake telegraphic transfers.
CABS’ total actual loss was US$1,136,179 and that no money had been recovered,” NPAZ added.
Malunga is facing a hacking charge and was remanded in custody pending his bail application.
