A new ATM malware strain dubbed FiXS has been observed targeting Mexican banks since the start of February 2023. Besides requiring interaction via an external keyboard, the Windows-based ATM malware is also vendor-agnostic and is capable of infecting any teller machine that supports CEN/XFS (short for eXtensions for Financial Services). The exact mode of compromise remains unknown but Metabase Q's Dan Regalado told The Hacker News that it's likely that "attackers found a way to interact with the ATM via touchscreen." FiXS is also said to be similar to another strain of ATM malware codenamed Ploutus that has enabled cybercriminals to extract cash from ATMs by using an external keyboard or by sending an SMS message.
One of the notable characteristics of FiXS is its ability to dispense money 30 minutes after the last ATM reboot by leveraging the Windows GetTickCount API. The sample analyzed by Metabase Q is delivered via a dropper known as Neshta (conhost.exe), a file infector virus that's coded in Delphi and which was initially observed in 2003. "FiXS is implemented with the CEN XFS APIs which helps to run mostly on every Windows-based ATM with little adjustments, similar to other malware like RIPPER," the cybersecurity company said. "The way FiXS interacts with the criminal is via an external keyboard."
This ATM malware is Hidden in another program, and is only visible once it's been installed on the machine. It is also vendor agnostic, which means it can infect any teller machine, as long as it's running Windows. The mode of compromise is still unknown, but it's likely that attackers found a way to interact with the ATM via touchscreen. This malware is also similar to another strain of ATM malware called Ploutus, which has enabled cybercriminals to extract cash from ATMs by using an external keyboard or by sending an SMS message. One of the notable characteristics of FiXS is its ability to dispense money 30 minutes after the last ATM reboot by leveraging the Windows GetTickCount API. The sample analyzed by Metabase Q is delivered via a dropper known as Neshta (conhost.exe), a file infector virus that's coded in Delphi and which was initially observed in 2003.