SWIFT is not a system.
SWIFT is an instruction protocol tied to a network that SWIFT Alliance Access (mentioned in article) gives access to, SWIFTNet.
Without going into details of failings of SWIFT authentication, which are few, this appears to be simple phishing:
The use of malware, suggested here, seems simple:
* There are a lot of manual steps in fund transfers that are either initiated manually (submitting a paper-based payment request, or even change to a company's authorised signature list) or requiring various manifests such as letter or credit clearing.
* Malware means the typical system of checking inputs are indeed true and correct (an inputter of the paper form, and a checker to verify it is true and correct) can be disrupted by replacing the scanned file between scanning and input (based on scan) or direct system access changing key numbers of codes.
* This comment is not a slight on Bangladesh. It is a general comment on developing economies I've interacted with in banking operations across Asia: Staff are often under-trained at a branch level and expected to perform a multitude of tasks under under-trained management. Local actors, for example local banks, often have completely insecure systems compared to international banks despite acting as correspondent bank in many transactions (added to the security-failure tool-chain). This is in contrast with outsourced operations in similar countries that run large service centers and most-often do an excellent job.
This appears to be fully not an error of SWIFT, but of using (the power of) SWIFT in combination with discrete and serious errors in injecting false records in non-audited/un-auditable systems that interact with SWIFT instructions and SWIFTNet.