Online Reporter
Yeukai Karengezeka-Chisepo-Court Correspondent
A MIDLANDS State University final-year computer science student accused of using malware to siphon over US$1,1 million from CABS through fraudulent VISA and ZIPIT transactions will remain in custody pending the determination of his bail application.
Sabelo Malunga (24), who is now legally represented, appeared before Harare regional magistrate Mrs Marehwanazvo Gofa yesterday on a charge of hacking.
The State, led by Mr Lawrence Gangarahwe, opposed his release on bail, while Malunga is expected to file written submissions in support of his application.
Mrs Gofa is expected to deliver her ruling on Thursday.
The State alleges that Malunga exploited access he had gained while working as an Information Technology intern at CABS between November 2025 and February 23, 2026.
The alleged cyber breach was discovered in March and April this year after CABS detected suspicious transactions involving its VISA and ZIPIT platforms.
The court heard that the matter came to light on March 27 when VISA flagged two suspicious international ATM transactions linked to CABS-issued debit cards.
CABS subsequently blocked the affected accounts, but had already suffered actual prejudice of US$925 679, which was allegedly transferred to EcoCash, InnBucks, CBZ and Ecobank.
Following the discovery, CABS engaged South African digital forensic firm MWR to contain and eradicate the malware and investigate the breach.
According to the forensic report, Malunga was allegedly linked to the cyberattack.
The court heard that on January 23, during working hours and while using a company-issued laptop, Malunga allegedly downloaded an application known as Supremo, without authorisation.
He allegedly concealed the application in system files to evade detection.
Supremo is a remote-access tool which the State alleges enabled Malunga to remotely access CABS data and systems.
The prosecution further alleges that after his internship ended on February 23, Malunga continued using the application to gain unauthorised access to the bank’s systems and servers.
