[![ATM Malware](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8Xw8AAoMBgDTD2qgAAAAASUVORK5CYII=)]() A new ATM malware strain dubbed **FiXS** has been observed targeting Mexican banks since the start of February 2023. "The ATM malware is hidden inside another not-malicious-looking program," Latin American cybersecurity firm Metabase Q [said]() in a report shared with The Hacker News. Besides requiring interaction via an external keyboard, the Windows-based ATM malware is also vendor-agnostic and is capable of infecting any teller machine that supports [CEN/XFS]() (short for eXtensions for Financial Services). The exact mode of compromise remains unknown but Metabase Q's Dan Regalado told The Hacker News that it's likely that "attackers found a way to interact with the ATM via touchscreen." FiXS is also said to be similar to another strain of [ATM malware]() codenamed [Ploutus]() that has enabled cybercriminals to extract cash from ATMs by using an external keyboard or by [sending an SMS message](). One of the notable characteristics of FiXS is its ability to dispense money 30 minutes after the last ATM reboot by leveraging the Windows [GetTickCount API](). The [sample]() analyzed by Metabase Q is delivered via a [dropper]() known as [Neshta]() (conhost.exe), a [file infector virus]() that's coded in Delphi and which was initially observed in 2003. "FiXS is implemented with the CEN XFS APIs which helps to run mostly on every Windows-based ATM with little adjustments, similar to other malware like [RIPPER]()," the cybersecurity company said. "The way FiXS interacts with the criminal is via an external keyboard." [![ATM Malware](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8Xw8AAoMBgDTD2qgAAAAASUVORK5CYII=)]() With this development, FiXS becomes the latest in a long list of malware such as [Ploutus](), [Prilex](), [SUCEFUL](), [GreenDispenser](), RIPPER, [Alice](), [ATMitch](), [Skimer](), and [ATMii]() that have targeted ATMs to siphon money. Prilex has since also [evolved]() into a modular point-of-sale (PoS) malware to perform credit card fraud through a variety of methods, including blocking contactless payment transactions. "Cybercriminals who compromise networks have the same end goal as those who carry out attacks via physical access: to dispense cash," Trend Micro [said]() in a detailed report on ATM malware published in September 2017. "However, instead of manually installing malware on ATMs through USB or CD, the criminals would not need to go to the machines anymore. They have standby money mules that would pick up the cash and go." Found this article interesting? Follow us on [Twitter __]() and [LinkedIn]() to read more exclusive content we post.

New FiXS ATM Malware Targeting Mexican Banks