Home / Crime and Justice / FBI Warns of Rampant ATM Jackpotting Malware
FBI Warns of Rampant ATM Jackpotting Malware
20 Feb
Summary
- Hackers stole over $20 million from ATMs in 2025.
- Malware like Ploutus forces ATMs to dispense cash without account deduction.
- Attacks leverage physical access and targeting of Windows OS.
ATM jackpotting, a technique first demonstrated in 2010, has transformed into a major criminal enterprise. Hackers rapidly escalated their attacks in recent years, with the FBI reporting over 700 incidents in 2025. These attacks resulted in at least $20 million in stolen cash.
Criminals employ a combination of methods, including gaining physical access to ATM components and deploying malicious software. One prominent malware, Ploutus, is effective against various ATM manufacturers by exploiting the Windows operating system. Ploutus grants full control, enabling ATMs to disburse cash without debiting customer accounts.
The malware specifically targets the XFS software used by ATMs to communicate with hardware. This allows for swift cash-out operations that can be completed in minutes and often go unnoticed until after the funds are gone. Previous security research had already identified vulnerabilities in XFS software that hackers could exploit.
