Blog 107a. Hackers Make ATMs Spit Cash — FBI Sounds Alarm on Ploutus Malware!

Key Takeaways

• FBI reports 1,900 jackpotting incidents since 2020
• 700 attacks occurred in 2025 alone
• Losses exceed $20 million from malware-driven cash-outs
• Ploutus malware enables “cardless” ATM withdrawals
• Banks urged to upgrade ATM security firmware

Summary

The FBI issued a FLASH advisory on February 19, 2026 warning that ATM jackpotting attacks are accelerating across the United States. Since 2020, roughly 1,900 incidents have been recorded, with 700 occurring in 2025 alone, and total losses topping $20 million. The attacks leverage the Ploutus malware, which enables criminals to dispense cash without a card. Law‑enforcement and financial institutions are scrambling to harden ATM firmware and monitoring systems.

Pulse Analysis

The recent FBI FLASH advisory marks a turning point in the fight against ATM jackpotting, a form of cyber‑crime that has moved from isolated incidents to a nationwide threat. By cataloguing nearly 2,000 attacks since 2020 and highlighting a spike to 700 incidents in 2025, the agency underscores the scale of financial loss—over $20 million—and the urgency for coordinated response. This data-driven warning serves as a wake‑up call for banks, regulators, and security vendors to reassess the resilience of their cash‑dispensing infrastructure.

At the technical core of the surge is Ploutus malware, a sophisticated code package that exploits legacy ATM operating systems and bypasses authentication mechanisms. Once installed, Ploutus can issue “cardless” cash‑out commands, effectively turning the machine into a money‑dumping device. The malware’s modular design allows attackers to adapt to different hardware models, making detection challenging for traditional antivirus solutions. Understanding its infection vectors—often through compromised service provider credentials or malicious USB devices—helps organizations prioritize patch management and network segmentation.

Industry reaction is already shifting toward proactive defense. Financial institutions are accelerating firmware updates, deploying intrusion‑detection sensors on ATM networks, and adopting multi‑factor authentication for service technicians. Regulators are considering stricter compliance standards that mandate real‑time monitoring and rapid incident reporting. As the threat landscape evolves, collaboration between banks, cybersecurity firms, and law‑enforcement will be critical to stay ahead of attackers and safeguard the cash supply chain. The coming months will likely see heightened investment in AI‑driven anomaly detection and stricter supply‑chain vetting for ATM components.