FBI says ‘big win’ attacks on ATMs are on the rise, with hackers pocketing millions in stolen funds.

In 2010, famous security researcher Barnaby Jack spectacularly hacked an ATM machine on stage at the Black Hat security conference, forcing it to spit out wads of bills in front of a stunned audience.

More than a decade later, ATM jackpot operations – as they are called – have broken away from the realms of theoretical security research and into the big business of the underworld.

According to a new security bulletin issued by the FBI, hackers have rapidly ramped up their attacks in recent years, with more than 700 attacks on cash machines during 2025 alone, resulting in hackers obtaining at least $20 million in stolen funds.

According to the bulletin, the FBI says hackers are using a combination of physical access to ATMs, such as public keys to open front panels and access hard drives, and digital tools, such as planting malware that can force ATMs to quickly dispense money in the blink of an eye.

The FBI has warned that a malware known as Ploutus is affecting a variety of ATM and cash dispenser manufacturers by targeting the Windows operating system platform that powers many ATMs. Plutos gives hackers full control of the compromised ATM, allowing them to issue instructions capable of tricking the dispenser into dispensing notes without withdrawing money from customers’ accounts.

Ploutus leverages the Extension for Financial Services, or XFS, software that ATMs rely on to communicate with various other hardware components, such as the PIN keypad, card reader, and the all-important cash dispensing unit.

“Ploutus attacks ATMs themselves rather than customer accounts, enabling rapid cash withdrawals that can occur in minutes, and are often difficult to detect until after the funds are withdrawn,” according to the FBI bulletin.

Security researchers previously discovered issues in XFS that could allow hackers to trick ATMs into distributing cash.

The lede paragraph has been updated to modify the date.