InfoSecBulletin Cybersecurity for mankind
A 19 February 2026 FBI FLASH (FLASH-20260219-001) alerts banks and ATM operators about an increase in “jackpotting,” where criminals use malware to steal cash from machines without actual transactions, becoming a widespread issue in the U.S.
The alert focuses on Ploutus, an ATM-targeting malware family that abuses eXtensions for Financial Services (XFS), the software layer that tells dispenser hardware what to do.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
In a typical withdrawal, the ATM app sends XFS commands for bank approval, but Ploutus allows intruders to send commands and skip authorization.
FBI analysts found that over 700 of about 1,900 jackpotting incidents since 2020 happened in 2025, resulting in losses of more than $20 million. Ploutus attacks ATMs directly, allowing it to dispense cash without needing a bank card or approval, enabling quick cash-outs.
Infection mechanism and on-box control:
After gaining physical access, attackers can remove the hard drive, connect it to another computer to copy the malware, and then reinstall it.
Many ATMs use Windows, allowing this method to be applied to various manufacturers with minimal code adjustments. The malicious program interacts directly with hardware via XFS, potentially functioning even when the ATM is offline and network alerts are inactive.
To stay in place and hide, responders should look for unexpected executables such as Newage.exe, NCRApp.exe, WinMonitor.exe, or sdelete.exe, new folders under paths like C:\Users\SSAuto1\AppData\Local\P, unauthorized remote tools like AnyDesk or TeamViewer, and registry autoruns or custom services with generic names like “ATM Service” and “Dispenser Service.”
The FBI suggests improving security with better locks, adding sensors and cameras, using disk encryption, and allowing only approved devices.
Validate each ATM using a trusted gold image and hash baseline. Enable targeted Windows auditing for USB insertions, file writes, process creation, and log clearing (Event IDs 6416, 4663, 4688, 1102) to help identify jackpotting and report findings to a local FBI office or IC3.
