FBI Reports 700 ATM Jackpotting Attacks Caused $20 Million in Losses in 2025
US Authorities Report Surge in ATM Jackpotting Attacks, $20 Million in Losses
A recent alert from the Federal Bureau of Investigation (FBI) warns of a significant increase in malware-enabled ATM jackpotting attacks across the United States.
Incidents and Losses
According to the agency, nearly 1,900 such incidents have been reported since 2020, with over 700 occurring in 2025 alone, resulting in losses exceeding $20 million.
ATM Jackpotting Attacks
ATM jackpotting attacks involve the physical compromise of a targeted machine to install malware that instructs the cash-dispensing module to eject currency.
The malware, often planted by individuals with physical access to the ATM, allows threat actors to trigger cash withdrawals remotely.
Malware Used
The FBI notes that multiple malware families are used in these attacks, but the most commonly associated is Ploutus.
This malware has been active for over a decade, with a resurgence in recent years.
Ploutus gives threat actors direct control over the compromised ATM, enabling fast cash-out operations that can occur in minutes and are often difficult to detect until after the money is withdrawn.
Detection and Prosecution
The malware can be used across ATMs from different manufacturers with minimal adjustments, as it exploits the Windows operating system during the compromise.
The FBI has provided indicators of compromise (IoCs) to help organizations detect these attacks.
This feature allows the malware to evade detection and continue to be used in attacks.
Prosecution and Prevention
The US has taken steps to crack down on ATM jackpotting, prosecuting dozens of individuals involved in these operations.
Many of the suspects are Venezuelan nationals who face deportation.
The Justice Department has also published a map showing the locations of jackpotting incidents in the US, highlighting the widespread nature of these attacks.
The FBI’s alert serves as a reminder for organizations to remain vigilant and take steps to protect their ATMs from these types of attacks.
By being aware of the indicators of compromise and taking proactive measures, organizations can reduce the risk of falling victim to these crimes.
About Author
English