MSU Student in Court Over Alleged US$1.1m CABS Cyber Theft

A 24-year-old Midlands State University (MSU) final-year Computer Science student has appeared in court accused of stealing more than US$1.1 million from CABS through an alleged malware attack on the bank's computer systems.

Sabelo Malunga is facing a hacking charge after prosecutors alleged that he gained unauthorised access to CABS systems while working as an IT intern between November 2025 and February 23, 2026. The allegations are yet to be tested in court. According to the State, Malunga was using a CABS-issued laptop on January 23 when he allegedly downloaded SUPREMO, a remote-access application, without authorisation.

Prosecutors allege that he subsequently concealed the application within system files to avoid detection. The State further alleges that Malunga continued accessing CABS systems even after his internship had ended.

CABS cyberattack allegedly generated fraudulent transactions

Prosecutors allege that the malware gave Malunga access that enabled him to bypass internal controls and create fraudulent ZIPIT and VISA transactions. The alleged cyber theft was discovered after VISA flagged two suspicious international ATM transactions on March 27. CABS reportedly blocked the affected accounts, but the State alleges that the bank had already suffered losses of US$210,500.

Further investigations allegedly uncovered a much larger fraud. On April 13, CABS' information technology team reportedly detected multiple malware infections on the bank's servers.

Investigators allegedly identified 1,911 fraudulent ZIPIT transactions worth US$925,679. According to the State, the money was transferred to accounts or wallets associated with EcoCash, InnBucks, CBZ and Ecobank.

Digital forensics allegedly links student to attack

CABS subsequently engaged South African digital forensics company MWR to investigate the suspected cyberattack and assist in removing the malware. The forensic investigation allegedly linked Malunga to the attack. Prosecutors further allege that the malware was used to create fraudulent transactions, bypass authorisation systems, generate fictitious transfers and produce fake telegraphic transfers. The alleged cyberattack resulted in an overall loss of US$1,136,179, according to the State.

No money had been recovered at the time of Malunga's court appearance, the prosecution alleged.

MSU student remanded in custody

Malunga was remanded in custody pending his bail application. The case highlights the growing risks faced by Zimbabwean banks and financial institutions from cybercrime, particularly as digital payment platforms and electronic banking transactions become increasingly important to the economy. Cybersecurity experts have repeatedly warned that financial institutions require strong access controls, monitoring systems and digital forensics capabilities to detect and contain sophisticated cyberattacks.

However, the allegations against Malunga remain subject to the court process, and he is presumed innocent unless proven guilty. The matter is expected to return to court for consideration of his bail application.

MSU student CABS cyber theft