MSU Student Accused Of Hacking CABS And Stealing US$1.1 Million
A final-year computer science student at Midlands State University has appeared in a Harare court accused of hacking CABS systems and facilitating fraudulent transactions that allegedly cost the bank US$1,136,179.
Sabelo Malunga, 24, appeared before regional magistrate Francis Mapfumo facing hacking charges. He was remanded in custody until Thursday, when his application for bail is expected to be heard.
The National Prosecuting Authority, represented by Blessed Songozo, alleges that Malunga gained access to CABS systems while undertaking an internship at the bank between November 2025 and February 23, 2026.
The allegations have not been tested at trial, and Malunga has not yet been asked to plead.
Suspicious Transactions Trigger Investigation
According to the State, the alleged breach was discovered in March after Visa alerted CABS to two suspicious international ATM withdrawals involving debit cards issued by the bank.
CABS blocked the affected accounts, but prosecutors said the bank had already lost US$210,500. The money has not been recovered.
An internal investigation conducted on April 13 allegedly found several malware infections on CABS servers.
YOU MAY ALSO LIKE: Treasury Faces Questions Over US$27.3 Million Cancer Equipment Spending
Further examination reportedly identified software being used to generate fraudulent ZIPIT transactions and inject them directly into the Zimswitch platform, allegedly bypassing the bank's internal security controls.
A subsequent reconciliation identified 1,911 allegedly fraudulent ZIPIT transactions valued at US$925,679. Prosecutors said the funds were transferred to accounts and mobile wallets associated with EcoCash, InnBucks, CBZ and Ecobank.
Forensic Investigation Allegedly Links Student To Breach
CABS subsequently engaged South African digital forensics company MWR to remove the malware, contain the breach and investigate how the bank's systems had been compromised.
Prosecutors allege that MWR's forensic investigation linked Malunga to the incident.
The State claims that on January 23, while still working as an intern, Malunga used a CABS-issued laptop to download an unauthorised remote-access application known as SUPREMO.
YOU MAY ALSO LIKE: Treasury Faces Questions Over US$27.3 Million Cancer Equipment Spending
He allegedly concealed the application among system files to avoid detection.
Prosecutors further allege that the software allowed Malunga to remotely access CABS computers and data.
State Alleges Access Continued After Internship
According to the prosecution, Malunga continued accessing CABS systems after his internship ended on February 23.
He is accused of installing malware capable of unlawfully authorising transactions, injecting fraudulent ZIPIT transfers into Zimswitch and routing fictitious payments to Ecobank through an integration between the institutions.
The State also alleges that the malware was used to generate fraudulent telegraphic transfers.
Prosecutors have put the bank's total alleged losses from the various transactions at US$1,136,179.
None of the money has been recovered, according to the State.
Malunga remains in custody pending the hearing of his bail application. The allegations against him remain unproven unless and until established in court.
