Cyberpediaby Brain
ENDEFR

Booby-trapped cables and fake keyboard devices

A USB cable or drive can pose as a keyboard and type commands on your behalf. Here is how to protect yourself.

In 30 seconds

Where it happens
At your workstation, when an unknown cable, drive or accessory is plugged into the computer, including an object received by post3.
What the attacker wants
To make the machine run commands, for example to download malware3.
The reflex
Plug in only hardware supplied or approved by the company, and hand any unknown object to IT.
If it has already happened
Unplug it, touch nothing else and tell IT without delay (common-sense advice, which the sources cited here do not give).

What it is

A USB cable or drive can look like an ordinary accessory and behave like a keyboard. The computer takes it for an input device and accepts what it "types", without the person at the screen having pressed a single key.

MITRE, which catalogues attack techniques, classes this method among hardware additions: accessories or devices physically introduced into a system to gain access. It lists keystroke injection among the capabilities of commercial and open-source products1. This article explains what this means for an employee.

Straight answers

Can a cable really type for me?

Yes. The sources cited here describe malicious USB drives that act as virtual keyboards, and keystroke injection as a capability of commercial and open-source products, used notably by offensive audit teams13. The names of common products in this field do not appear in the sources cited here, except the Bash Bunny, used by the DarkVishnya group1.

Does antivirus stop it?

The sources cited here do not say. They recommend not plugging in an unknown drive, turning off autorun and keeping security software up to date5. MITRE, for its part, gives a basic measure: blocking unknown devices and accessories through the workstation's security configuration1.

Why is an object received by mail dangerous?

Because the attacker does not need to enter the premises. MITRE reports that FIN7 actors mailed USB drives to potential victims3. CISA adds that attackers have infected objects during manufacturing, such as digital photo frames or USB drives5.

What should I do with a drive found on the ground?

Do not plug it in, even to see its contents or find its owner. CISA asks that it be handed to the right people: the site's security staff or the organisation's IT department5.

1Inside the attacker's head1 min

The attacker is looking for initial access. For MITRE, a hardware addition is richer than a simple storage drive: it gives the machine new functions that can then be misused1. Keystroke injection is one of them1.

The attacker also needs a reason for the object to be plugged in. CISA describes attackers who pose as a new employee, a repairer or a researcher, presenting credentials7.

The entry cost is low for some related attacks. Microsoft describes direct memory access attacks that often take a few minutes, with cheap, commercially sold hardware and software, without taking the device apart. An attacker can plug in a USB-type device during the owner's break and leave with the machine's secrets6.

2What you see on screen1 min

The sources cited here do not describe the victim's screen in general terms. Only one detail is documented: FIN7 used malicious USB drives to open the Run dialog box with the Windows + R key combination, then launched a command prompt3. A window that opens by itself just after something is plugged in is therefore a signal to take seriously.

The sources do not say whether the attack leaves a visible trace in every case, or how long it lasts. A lack of any sign on screen therefore proves nothing. Security teams rely on other signs: MITRE describes detecting a new device recognised by Windows, followed shortly after by processes launched from the same session and possible keystroke injection1.

3Under the hoodIT teams1 min

The principle fits in one sentence: the device presents itself to the computer as a keyboard, and the computer obeys its keystrokes. The sources cited here confirm this for FIN7, some of whose USB drives acted as virtual keyboards3. They do not detail the technical protocol or the typing speed.

Once the keys are sent, what follows is conventional. FIN7 used these drives to launch PowerShell, then download and run malware from the attacker's server3. PowerShell is a command environment built into Windows, which attackers can use to discover information and run code4.

The charging cable case is similar. MITRE notes that mobile devices and, in some cases, USB charging cables can be used to infect a computer2. This mention concerns spread through removable media, not keystroke input.

On the defence side, two measures stand out in the sources. The first is to block unknown devices and accessories through the security configuration1. The second applies only to direct memory access devices (Thunderbolt, USB4): by default, Windows can prevent those with incompatible drivers from starting until an authorised user has signed in or unlocked the screen, and an administrator can change this behaviour6. This protection does not cover FireWire, PCMCIA, CardBus or ExpressCard6.

4Case filesReal cases1 min

FIN7 and the mailed USB drives

FIN7 is a financially motivated criminal group active since 2013. Since 2020, it has turned to big game hunting, using the REvil ransomware and its own service, Darkside3.

According to MITRE, FIN7 actors mailed USB drives to potential victims. They contained malware that installs several backdoors, sometimes in preparation for ransomware operations3. The group also used drives that behaved like virtual keyboards to install malware, as well as text files that decode into PowerShell commands3.

In detail, these drives sent Windows + R to open the Run box, then launched a command prompt3. Others emulated keystrokes to start PowerShell, then download and run a program from the attacker's server3.

MITRE points to press articles from January 2022, including one dated 7 January 2022 titled "FBI: FIN7 hackers target US companies with BadUSB devices to install ransomware"3. The sources cited here describe neither the packaging of the shipments nor their disguise as a gift or official mail.

Fact sheet

Identifier
CP-084
Wing
1. Attacks and techniques
Brain skill
Securing Devices & Mobile (secure_devices)
Brain reflex
cr-051
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
7 sources checked on 3 November 2026
Sources7 sources
  1. MITRE ATT&CK, “Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1200/ (accessed 3 November 2026)
  2. MITRE ATT&CK, “Replication Through Removable Media, Technique T1091 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1091/ (accessed 3 November 2026)
  3. MITRE ATT&CK, “FIN7, GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS, Sangria Tempest, Group G0046 | MITRE ATT&CK®”. https://attack.mitre.org/groups/G0046/ (accessed 3 November 2026)
  4. MITRE ATT&CK, “Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1059/001/ (accessed 3 November 2026)
  5. CISA, “Using Caution with USB Drives | CISA”, 1 February 2021. https://www.cisa.gov/news-events/news/using-caution-usb-drives (accessed 3 November 2026)
  6. Microsoft, “Kernel DMA Protection”. https://learn.microsoft.com/en-us/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt (accessed 3 November 2026)
  7. CISA, “Avoiding Social Engineering and Phishing Attacks | CISA”, 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026)

Cite this article

Brain, “Booby-trapped cables and fake keyboard devices”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/booby-trapped-cables-hid-keyboard-emulation/

BibTeX 
@misc{brain_cp084_en_2026,
  author = {Brain},
  title = {Booby-trapped cables and fake keyboard devices},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/booby-trapped-cables-hid-keyboard-emulation/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence