The FBI has issued a warning about a significant rise in ATM ‘jackpotting’ attacks, where hackers manipulate ATMs to dispense cash illicitly, resulting in millions of dollars in stolen currency. This criminal activity, once a demonstration by security researcher Barnaby Jack, has escalated into a profitable venture for cybercriminals.
According to the FBI’s security bulletin, over 700 attacks targeted ATMs in 2025, yielding at least $20 million for hackers. The attacks involve a combination of physical access techniques, like using generic keys to unlock ATM components, and digital methods, such as deploying malware like Ploutus to force dispensers to release cash rapidly.
Ploutus, a malware strain highlighted by the FBI, exploits vulnerabilities in the underlying Windows operating system that powers many ATMs. By compromising an ATM, hackers gain full control, enabling them to manipulate the cash dispensing process without affecting customer accounts directly.
This type of attack, focused on the ATM hardware itself, allows for quick cash-out operations that are challenging to detect until after the money is withdrawn. The FBI’s bulletin underscores the urgency for financial institutions to address security gaps in their ATM systems to prevent further exploitation by cybercriminals.
Source: TechCrunch