US$1.1M gone: MSU student denied bail over CABS hack
A Midlands State University Computer Science final-year student facing charges of stealing more than US$1.1 million from CABS has been refused bail.
Sabelo Malunga, 24, is accused of using malware to carry out fraudulent VISA and ZIPIT transactions. He appeared before Harare regional magistrate Marehwanazvo Gofa, who said the seriousness of the case and the risk of him skipping the country meant bail could not be granted.
The magistrate also pointed out that some of Malunga’s suspected accomplices are still missing and are thought to be in South Africa.
The case was postponed to September 21 for further remand.
Prosecutors claim Malunga took advantage of access he had while serving as an IT intern at CABS between November 2025 and February 23, 2026.
The alleged breach came to light in March and April after CABS flagged unusual activity on its VISA and ZIPIT systems.
According to court records, on March 27 VISA alerted the bank to two questionable international ATM withdrawals made with CABS debit cards.
By then, CABS had already lost US$925,679. The bank moved to freeze the affected accounts.
Investigators say the stolen funds were moved through EcoCash, InnBucks, CBZ and Ecobank.
After the incident, CABS hired South African cybersecurity firm MWR to remove the malware and probe the attack.
A forensic report reportedly links Malunga to the hack. The State alleges that on January 23, while using a company laptop at work, he secretly installed an app called SUPREMO and hid it in system files to avoid detection.
SUPREMO is a remote-access program that prosecutors say allowed Malunga to get into CABS’ systems and data from anywhere.
The court heard that even after his internship ended on February 23, Malunga allegedly kept using the tool to break into the bank’s servers.
He is further accused of deploying malware that enabled unauthorized transaction approvals, fake ZIPIT transfers via Zimswitch, bogus payments sent to Ecobank, and the creation of false telegraphic transfers.
In total, the State says CABS suffered losses of US$1,136,179. The court was told no money has been recovered so far.
