A system for detecting security threats in automated teller machines (ATMs) extracts baseline features from a first set of signals received from a first ATM, when the first ATM is initiated to operate. The baseline features represent a unique electrical signature of the first ATM. The system extracts test features from a second set of signals received from the first ATM, when the first ATM is in operation. The system determines whether there is a deviation between the test features and baseline features. If the system detects the deviation, the system determines that the first ATM is associated with a particular anomaly that makes the first ATM vulnerable to unauthorized access. The system determines that a second ATM is associated with the particular anomaly if the system detects the deviation between baseline features and test features associated with the second ATM.