The threat is ATM jackpotting, a cyber-physical attack where criminals gain physical access to a machine using generic keys and install malware like Ploutus, which exploits the eXtensions for Financial Services (XFS) layer to bypass bank authorization and force the ATM to dispense cash on demand. The FBI reported over 700 such incidents in 2025, resulting in over $20 million in losses. To defend against these attacks, the FBI recommends auditing ATM systems for signs of unauthorized removable storage use and unauthorized processes, and implementing gold image integrity validation for early detection of physical intrusion.
The attacks cost banks more than $20 million in losses last year, as criminals used many of the same tools and tactics they have wielded for more than a decade.