WinPot. This is the name of the malware that turns ATMs into slot machines. Its creators were probably inspired by the term jackpotting - which refers to attacks in which cybercriminals force an ATM to literally spit out money.

WinPot looks like a slot game: individuals really expect money to be released at ATMs. There is a difference between the operation of the gaming machines and WinPot, as it guarantees "victory".


Perhaps, even, this explains the first part of its name: there is no possibility of defeat, as it happens in casinos. The windows of the slot machine show the name of the banknotes and the number of banknotes in each dispenser. You just need to choose the exit that has the most money and press "Spin".

You can use the “Scan” option to retell the notes. The system predicts possible mishaps, so there is a “Stop” button. In an emergency, the function blocks looting before raising suspicions about the criminal.


WinPot malware interface

There are several versions of WinPot. Each with its own features and resources. This variety helps both to prevent the virus from circumventing new ATM protection measures and to prevent abuse - such as someone trying to copy the software to keep all the money in the next crime. Some types of malware operate for a limited time and are then disabled. 

The actions of cybercriminals, however, are not just stealing ATMs. There are multiple ways to steal money from bank customers: hidden cameras, fake keyboards and other devices to obtain passwords and data from the card's magnetic stripe.

Often, the user does not notice anything unusual about the appearance of the machine. Therefore, it is recommended, according to Kaspersky Lab, to activate notifications of text messages about withdrawals and transfers (thus, you can block the card as soon as possible), use cashiers at bank branches (more difficult to reprogram), stay as close to the terminal as possible, cover the keyboard with your hand when entering the password and pay attention to any unusual signs on the external appearance of the ATM or on what is shown on the screen.