FBI Reports 700 ATM Jackpotting Attacks Caused $20 Million in Losses in 2025

Post Views: 106

ATM Jackpotting Attacks on the Rise in the US

A recent alert from the Federal Bureau of Investigation (FBI) highlights a surge in malware-enabled ATM jackpotting attacks in the United States, resulting in significant financial losses.

Incidents and Losses

According to the agency, approximately 1,900 such attacks have been reported since 2020, with over 700 incidents occurring in 2025 alone. The total losses attributed to these attacks in 2025 exceeded $20 million.

How ATM Jackpotting Works

ATM jackpotting attacks involve the physical compromise of an ATM to install malware that instructs the machine’s cash-dispensing module to eject currency. The malware, often installed by individuals with physical access to the ATM, allows attackers to remotely control the machine and trigger cash withdrawals.

Malware Used in Attacks

The FBI notes that multiple malware families are used in these attacks, with the Ploutus malware being the most frequently employed. Ploutus, which has been active for over a decade, allows attackers to gain direct control over the compromised ATM, enabling fast cash-out operations that can occur in minutes and are often difficult to detect.

According to the FBI, Ploutus is designed to delete its own code, making it challenging for forensic investigators and bank employees to detect.

Indicators of Compromise and Prevention

The FBI has provided indicators of compromise (IoCs) to help organizations detect and prevent these attacks. However, the agency’s alert serves as a reminder of the ongoing threat posed by ATM jackpotting attacks and the need for increased vigilance in the financial sector.

Prosecution and Prevention Efforts

The US has taken steps to combat these attacks, prosecuting dozens of individuals involved in ATM jackpotting operations. Many of those targeted by the Justice Department are Venezuelan nationals who face deportation.

Recommendations for Financial Institutions

The continued use of Ploutus malware in these attacks highlights the need for financial institutions to remain vigilant and implement robust security measures to protect their ATMs from compromise.