WATCH: Zimbabwean Student Hacks Top Bank CABS And Steals $1USD Million

• Sabelo Malunga, a 24-year-old final-year Computer Science student at Midlands State University (MSU).

• The Charges: Charged with hacking CABS and siphoning over US$1.1 million.

• The Method: Allegedly installed an unauthorized remote-access application (SUPREMO) on a CABS-issued laptop during his internship, which he then used to access the bank’s servers remotely after his internship ended.

• The Malware: An internal audit later uncovered malware that:

  • Bypassed authorization controls.

  • Created fraudulent ZIPIT transactions directly through Zimswitch.

  • Generated fake telegraphic transfers.

• The Financial Impact: Estimated total loss of US$1,136,179, broken down into:

  • US$925,679 from 1,911 fraudulent ZIPIT transactions.

  • US$210,500 from suspicious international ATM withdrawals.

• The Routing of Stolen Funds: The stolen funds were routed through a multi-tier strategy to obscure the trace, using:

  • Third-party financial endpoints and digital wallets (EcoCash, InnBucks, CBZ, Ecobank).

  • Exploitation of bank integrations (e.g., CABS-Ecobank) for bogus ledger updates.

  • Fake telegraphic transfer (TT) instructions.

  • International ATM cash-outs via VISA debit cards.

• The Investigation: CABS engaged a South African digital forensics firm (MWR), which traced the system intrusion directly back to Malunga.

• Court Appearance: Malunga appeared in court on 31 August 2026 and was remanded in custody pending a bail hearing.

Timeline of Events:

• November 2025: Malunga begins his IT internship at CABS.

• 23 January 2026: Malunga allegedly downloads the unauthorized remote-access application (SUPREMO) onto his CABS-issued laptop.

• 23 February 2026: Malunga completes his internship at CABS.

• 27 March 2026: VISA alerts CABS to two suspicious international ATM withdrawals; CABS blocks affected accounts after an initial loss of US$210,500.

• 13 April 2026: CABS’ internal IT team discovers multiple malware infections on its servers during an internal audit.

• Mid-2026: CABS engages South African digital forensics firm MWR, whose forensic analysis links the breach to Malunga.

• 31 August 2026: Malunga appears in court facing hacking charges and is remanded in custody.