In 2025, ATM jackpotting attacks surged dramatically, affecting over 700 machines across the United States and netting criminals at least $20 million. The FBI has issued a security bulletin alerting financial institutions about these attacks, which involve a combination of physical access tactics and sophisticated malware infections.
Criminals often employ generic keys to unlock ATM panels, granting them direct access to the systems. Once inside, they install malicious software—most commonly the Ploutus malware—that exploits the Windows-based operating systems of many ATMs. This malware leverages the XFS (eXtensions for Financial Services) API to issue commands for cash dispensing without debiting customer accounts, making these attacks both lucrative and difficult to detect.
The FBI’s records show around 1,900 incidents of ATM jackpotting since 2020, with over 93 individuals charged, including members of the notorious Tren de Aragua gang. The attacks often exploit legacy operating systems, inadequate physical security measures, and weak locks that can be opened with readily available generic keys.
In response to these sophisticated attacks, security experts have recommended several measures to strengthen ATM infrastructure. These include enforcing application whitelisting, implementing TPM-backed secure boot processes, utilizing multi-factor authentication for remote access, deploying tamper detection mechanisms, and replacing default locks with more secure options.
Additionally, the FBI’s alert lists several important indicators of compromise for financial institutions to monitor. These include abnormal USB activity, the presence of unauthorized devices, and specific event IDs that could signify a potential security breach.
By taking heed of these recommendations, financial institutions can better protect their ATMs from the increasing threat of jackpotting attacks and safeguard against substantial financial losses.

Collections

ATM jackpotting attacks surged in 2025, compromising over 700 machines across the US and netting criminals more than $20 million. The FBI issued a security bulletin detailing how attackers use generic keys for physical access and deploy Ploutus malware, which exploits the XFS API on Windows-based ATM systems to dispense cash without debiting accounts. Since 2020, roughly 1,900 incidents have been recorded and 93 individuals charged. Recommended defenses include application whitelisting, TPM-backed secure boot, multi-factor authentication for remote access, tamper detection, and replacing default locks. Financial institutions are also advised to monitor for abnormal USB activity, unauthorized devices, and specific event IDs as indicators of compromise.

FBI Warns of Increasing ATM 'Jackpotting' Attacks with $20 Million Stolen in 2025