Malware is making ATMs ‘spit cash’