InfoSecBulletin Cybersecurity for mankind
A 19 February 2026 FBI FLASH (FLASH-20260219-001) alerts banks and ATM operators about an increase in “jackpotting,” where criminals use malware to steal cash from machines without actual transactions, becoming a widespread issue in the U.S.
The alert focuses on Ploutus, an ATM-targeting malware family that abuses eXtensions for Financial Services (XFS), the software layer that tells dispenser hardware what to do.
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
In a typical withdrawal, the ATM app sends XFS commands for bank approval, but Ploutus allows intruders to send commands and skip authorization.
FBI analysts found that over 700 of about 1,900 jackpotting incidents since 2020 happened in 2025, resulting in losses of more than $20 million. Ploutus attacks ATMs directly, allowing it to dispense cash without needing a bank card or approval, enabling quick cash-outs.
Infection mechanism and on-box control:
After gaining physical access, attackers can remove the hard drive, connect it to another computer to copy the malware, and then reinstall it.
Many ATMs use Windows, allowing this method to be applied to various manufacturers with minimal code adjustments. The malicious program interacts directly with hardware via XFS, potentially functioning even when the ATM is offline and network alerts are inactive.
To stay in place and hide, responders should look for unexpected executables such as Newage.exe, NCRApp.exe, WinMonitor.exe, or sdelete.exe, new folders under paths like C:\Users\SSAuto1\AppData\Local\P, unauthorized remote tools like AnyDesk or TeamViewer, and registry autoruns or custom services with generic names like “ATM Service” and “Dispenser Service.”
The FBI suggests improving security with better locks, adding sensors and cameras, using disk encryption, and allowing only approved devices.
Validate each ATM using a trusted gold image and hash baseline. Enable targeted Windows auditing for USB insertions, file writes, process creation, and log clearing (Event IDs 6416, 4663, 4688, 1102) to help identify jackpotting and report findings to a local FBI office or IC3.
