--- id: CP-026 slug: juice-jacking-public-usb-charging lang: en title: Juice jacking and public USB chargers description: A booby-trapped USB device or port can infect a phone or computer. What the victim sees and the reflexes to adopt. canonical_url: https://startbrain.io/cyberpedia/en/articles/juice-jacking-public-usb-charging/ markdown_url: https://startbrain.io/cyberpedia/en/articles/juice-jacking-public-usb-charging.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Juice jacking and public USB chargers", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/juice-jacking-public-usb-charging/ (CC BY 4.0) wing: 1 theme: outsmart_social_engineering reflex: cr-045 schema: G5 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/juice-jacking-public-usb-charging/ fr: https://startbrain.io/cyberpedia/fr/articles/juice-jacking-bornes-usb-publiques/ de: https://startbrain.io/cyberpedia/de/articles/juice-jacking-offentliche-usb-ladestationen/ es: https://startbrain.io/cyberpedia/es/articles/juice-jacking-estaciones-carga-usb-publicas/ sources: - "n": 1 title: Replication Through Removable Media, Technique T1091 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1091/ accessed: "2026-11-03" - "n": 2 title: Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1200/ accessed: "2026-11-03" - "n": 3 title: Limit Hardware Installation, Mitigation M1034 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/mitigations/M1034/ accessed: "2026-11-03" - "n": 4 title: Exfiltration Over Physical Medium, Technique T1052 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1052/ accessed: "2026-11-03" - "n": 5 title: Avoiding Social Engineering and Phishing Attacks | CISA publisher: CISA url: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks published: "2021-02-01" accessed: "2026-11-03" - "n": 6 title: "Phishing attacks: defending your organisation" publisher: NCSC (UK) url: https://www.ncsc.gov.uk/guidance/phishing published: "2018-02-05" accessed: "2026-11-03" --- # Juice jacking and public USB chargers Juice jacking is the idea that a USB charging port, a publicly accessible charging station or a cable left in place can be used to attack the device plugged into it. The sources cited here do not use this name and describe no booby-trapped public charging station. They do document the underlying mechanism: a device connected by USB can be used to infect a computer [1], and USB drives and plugged-in devices have already been used to attack companies [1][2]. This article sticks to what these sources say. It reports neither a police warning nor a public demonstration of an attack, for lack of a source that establishes them. ## In 30 seconds - Where it happens: on a computer or phone connected by USB to a device, cable or medium that the employee does not control. - What the attacker wants: to get malicious software run, or to imitate a keyboard in order to install programs [1][2]. - The reflex: do not plug any cable, USB drive or accessory of unknown origin into company equipment, and report it to the IT team. - If it is already done: tell the people in charge of security without delay, without fear of blame [5][6]. ## Straight answers ### What harm can a USB cable or port do? According to the MITRE page on removable media, a mobile device connected by USB to a computer can infect it. This can happen through Android or iOS devices and, in some cases, through USB charging cables [1]. When a phone is plugged in, it can appear as a disk connected by USB. If compatible malicious software is on the phone, it can infect the machine, especially when the Autorun feature is enabled [1]. ### What does the victim see? The sources cited here do not describe the messages shown on screen, nor those that ask the user to trust a device. They only indicate that the medium can appear as a disk drive [1]. They also describe keystroke injection as a capability of some accessories [2]. ### Can a USB accessory pass itself off as a keyboard? According to MITRE, yes for accessories and other devices: among the capabilities of hardware accessories used by red teams, the page lists keystroke injection [2]. It does not mention a cable in this respect. The FIN7 group used malicious USB drives that behaved like virtual keyboards to install malware [1]. ### Is the risk common? The MITRE page on hardware additions states that public references to use by attackers are rare, while many red teams use them to gain initial access [2]. This page does not allow the risk to be quantified for a public charging station. ### Is it only a risk of data theft? No. MITRE also describes exfiltration through a physical medium, for example an external drive, a USB drive or a phone [4]. It mainly describes the installation of malware through removable media [1]. ## Inside the attacker's head The attacker aims for initial access. The sources describe two families of methods. The first is the removable medium that contains malware and takes advantage of Autorun when plugged in [1]. The second is the more elaborate accessory: MITRE notes that these hardware additions introduce new functions into a system, instead of only delivering files through a storage medium [2]. CISA describes social engineering as the use of human interaction to obtain or compromise information about an organization [5]. In the FIN7 mail case described below, one can infer that the victim has to plug in the received medium themselves, but the source does not say so. ## What you see on screen In the sources cited here, nothing specifies what is displayed. Two points emerge. A phone connected to a computer can appear on it as a disk drive [1]. And the sources mention drives that simulate a keyboard and keystroke injection [1][2]: one can infer that these keystrokes are not typed by the victim, but the sources do not say so. ## Under the hood The sources give these technical elements: - Autorun: malware such as Conficker used the Windows Autorun feature to spread over USB [1]. - Fake keyboard: accessories can inject keystrokes, read kernel memory through DMA or modify network traffic [2]. - Exfiltration: data can leave on an external drive, a USB drive, a phone or an MP3 player [4]. On the defense side, MITRE recommends limiting the use of USB devices and removable media on a network [3]. The detailed measure includes disabling USB ports through group policy and a list of devices allowed by serial number. It also provides for device control tools that let certain types of hardware through, such as keyboards and mice, and block others [3]. Disabling Autorun when it is not needed, and restricting removable media, are also among the measures [1][4]. ## Case files ### DarkVishnya, physical access to bank networks MITRE cites the DarkVishnya group, which physically plugged a Bash Bunny, a Raspberry Pi, cheap netbooks and laptops into the targeted organization's environment in order to access its local network [2]. The associated reference is an article dated 6 December 2018 about banks attacked through direct connection to the local network [2]. The sources cited here do not give the date of the events themselves. ### FIN7 and the USB drives sent by mail MITRE reports that FIN7 actors mailed USB drives to potential victims. They contained malware that downloads and installs several backdoors, including, in some cases, for ransomware operations [1]. The page points to two references from January 2022, one dated 7 January 2022 and the other 13 January 2022 [1]. The same passage mentions drives that acted as virtual keyboards [1]. ### A charging cable cited as a reference The page on removable media lists, among its references, an article dated 12 August 2019 titled « This hacker’s iPhone charging cable can hijack your computer » [1]. The source does not summarize its content: it serves here only to show that the charging cable is among the cases MITRE mentions. ## Questions on conduct ### What should you do in practice? The sources provide no instruction specific to public charging stations. The measures they give concern the organization: - Limit the use of USB devices and removable media on the network [3]. - Block unknown devices and accessories through the security configuration of workstations [2][3]. - Report. CISA advises anyone who thinks they have revealed sensitive information to notify the relevant people in the organization, including network administrators [5]. The NCSC recommends not reprimanding users who are in difficulty, because those who fear punishment do not report their mistakes [6]. For an employee, this amounts to not connecting to their workstation a cable, USB drive or accessory found or received unrequested, then telling the IT team about it. This conduct follows from the FIN7 and DarkVishnya cases more than from a rule stated by a source. ## Sources 1. MITRE ATT&CK, "Replication Through Removable Media, Technique T1091 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1091/ (accessed 3 November 2026) 2. MITRE ATT&CK, "Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1200/ (accessed 3 November 2026) 3. MITRE ATT&CK, "Limit Hardware Installation, Mitigation M1034 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/mitigations/M1034/ (accessed 3 November 2026) 4. MITRE ATT&CK, "Exfiltration Over Physical Medium, Technique T1052 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1052/ (accessed 3 November 2026) 5. CISA, "Avoiding Social Engineering and Phishing Attacks | CISA", 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026) 6. NCSC (UK), "Phishing attacks: defending your organisation", 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/juice-jacking-public-usb-charging/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.