By Tichaona Katsvamutima
A US$1.1 million cybercrime case currently before the courts has brought the security of Zimbabwe’s banking systems into sharp focus, raising broader questions about how financial institutions manage internal access to critical technology infrastructure.
At the centre of the case is 24-year-old Midlands State University Computer Science student Sabelo Malunga, who appeared before Harare regional magistrate Francis Mapfumo facing a hacking charge.
Malunga is a former Information Technology intern at CABS.
According to allegations presented by the State, Malunga worked at CABS between November 2025 and February 23, 2026.
Prosecutors allege that while still attached to the bank, he downloaded SUPREMO, a remote-access application, onto a company-issued laptop without authorisation and concealed it within system files.
The State further alleges that remote access to CABS systems continued after his internship had ended.
Court papers indicate that concerns emerged after VISA flagged two suspicious international ATM transactions involving CABS-issued debit cards on March 27.
The affected accounts were subsequently blocked, with prosecutors putting the alleged loss from those transactions at US$210 500.
On April 13, CABS’ IT team reportedly discovered malware on its servers while investigating suspicious activity.
According to the prosecution, the malware was capable of generating ZIPIT transactions and injecting them directly into Zimswitch.
A reconciliation exercise subsequently identified 1 911 transactions worth US$925 679 which the State alleges were fraudulent.
The transactions were allegedly directed to EcoCash, InnBucks, CBZ and Ecobank.
CABS later engaged South African digital forensic specialists MWR to investigate the breach and contain the malware.
Prosecutors say findings from that investigation subsequently linked Malunga to the alleged intrusion.
The State puts the total alleged prejudice suffered by CABS at US$1 136 179, with no money recovered so far.
While the courts will ultimately determine the criminal allegations against Malunga, the case also brings into focus wider cybersecurity questions facing financial institutions.
Banks increasingly depend on interconnected digital platforms, third-party systems and employees with varying levels of privileged access, making controls around software installation, remote access and the termination of system privileges critical.
The circumstances surrounding the CABS incident — and precisely how the alleged breach occurred — are now matters likely to be examined through the judicial process.
.
