Cyberpediaby Brain
ENDEFR

Juice jacking and public USB chargers

A booby-trapped USB device or port can infect a phone or computer. What the victim sees and the reflexes to adopt.

In 30 seconds

Where it happens
On a computer or phone connected by USB to a device, cable or medium that the employee does not control.
What the attacker wants
To get malicious software run, or to imitate a keyboard in order to install programs12.
The reflex
Do not plug any cable, USB drive or accessory of unknown origin into company equipment, and report it to the IT team.
If it is already done
Tell the people in charge of security without delay, without fear of blame56.

What it is

Juice jacking is the idea that a USB charging port, a publicly accessible charging station or a cable left in place can be used to attack the device plugged into it. The sources cited here do not use this name and describe no booby-trapped public charging station. They do document the underlying mechanism: a device connected by USB can be used to infect a computer1, and USB drives and plugged-in devices have already been used to attack companies12.

This article sticks to what these sources say. It reports neither a police warning nor a public demonstration of an attack, for lack of a source that establishes them.

Straight answers

What harm can a USB cable or port do?

According to the MITRE page on removable media, a mobile device connected by USB to a computer can infect it. This can happen through Android or iOS devices and, in some cases, through USB charging cables1. When a phone is plugged in, it can appear as a disk connected by USB. If compatible malicious software is on the phone, it can infect the machine, especially when the Autorun feature is enabled1.

What does the victim see?

The sources cited here do not describe the messages shown on screen, nor those that ask the user to trust a device. They only indicate that the medium can appear as a disk drive1. They also describe keystroke injection as a capability of some accessories2.

Can a USB accessory pass itself off as a keyboard?

According to MITRE, yes for accessories and other devices: among the capabilities of hardware accessories used by red teams, the page lists keystroke injection2. It does not mention a cable in this respect. The FIN7 group used malicious USB drives that behaved like virtual keyboards to install malware1.

Is the risk common?

The MITRE page on hardware additions states that public references to use by attackers are rare, while many red teams use them to gain initial access2. This page does not allow the risk to be quantified for a public charging station.

Is it only a risk of data theft?

No. MITRE also describes exfiltration through a physical medium, for example an external drive, a USB drive or a phone4. It mainly describes the installation of malware through removable media1.

1Inside the attacker's head1 min

The attacker aims for initial access. The sources describe two families of methods. The first is the removable medium that contains malware and takes advantage of Autorun when plugged in1. The second is the more elaborate accessory: MITRE notes that these hardware additions introduce new functions into a system, instead of only delivering files through a storage medium2.

CISA describes social engineering as the use of human interaction to obtain or compromise information about an organization5. In the FIN7 mail case described below, one can infer that the victim has to plug in the received medium themselves, but the source does not say so.

2What you see on screen1 min

In the sources cited here, nothing specifies what is displayed. Two points emerge. A phone connected to a computer can appear on it as a disk drive1. And the sources mention drives that simulate a keyboard and keystroke injection12: one can infer that these keystrokes are not typed by the victim, but the sources do not say so.

3Under the hoodIT teams1 min

The sources give these technical elements:

  • Autorun: malware such as Conficker used the Windows Autorun feature to spread over USB1.
  • Fake keyboard: accessories can inject keystrokes, read kernel memory through DMA or modify network traffic2.
  • Exfiltration: data can leave on an external drive, a USB drive, a phone or an MP3 player4.

On the defense side, MITRE recommends limiting the use of USB devices and removable media on a network3. The detailed measure includes disabling USB ports through group policy and a list of devices allowed by serial number. It also provides for device control tools that let certain types of hardware through, such as keyboards and mice, and block others3. Disabling Autorun when it is not needed, and restricting removable media, are also among the measures14.

4Case filesReal cases1 min

DarkVishnya, physical access to bank networks

MITRE cites the DarkVishnya group, which physically plugged a Bash Bunny, a Raspberry Pi, cheap netbooks and laptops into the targeted organization's environment in order to access its local network2. The associated reference is an article dated 6 December 2018 about banks attacked through direct connection to the local network2. The sources cited here do not give the date of the events themselves.

FIN7 and the USB drives sent by mail

MITRE reports that FIN7 actors mailed USB drives to potential victims. They contained malware that downloads and installs several backdoors, including, in some cases, for ransomware operations1. The page points to two references from January 2022, one dated 7 January 2022 and the other 13 January 20221. The same passage mentions drives that acted as virtual keyboards1.

A charging cable cited as a reference

The page on removable media lists, among its references, an article dated 12 August 2019 titled « This hacker’s iPhone charging cable can hijack your computer »1. The source does not summarize its content: it serves here only to show that the charging cable is among the cases MITRE mentions.

5Questions on conduct1 min

What should you do in practice?

The sources provide no instruction specific to public charging stations. The measures they give concern the organization:

  • Limit the use of USB devices and removable media on the network3.
  • Block unknown devices and accessories through the security configuration of workstations23.
  • Report. CISA advises anyone who thinks they have revealed sensitive information to notify the relevant people in the organization, including network administrators5. The NCSC recommends not reprimanding users who are in difficulty, because those who fear punishment do not report their mistakes6.

For an employee, this amounts to not connecting to their workstation a cable, USB drive or accessory found or received unrequested, then telling the IT team about it. This conduct follows from the FIN7 and DarkVishnya cases more than from a rule stated by a source.

Fact sheet

Identifier
CP-026
Wing
1. Attacks and techniques
Brain skill
Outsmarting Social Engineering (outsmart_social_engineering)
Brain reflex
cr-045
Diagram
G5 · Employee Decision Tree
Languages
de, en, fr
Sources
6 sources checked on 3 November 2026
Sources6 sources
  1. MITRE ATT&CK, “Replication Through Removable Media, Technique T1091 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1091/ (accessed 3 November 2026)
  2. MITRE ATT&CK, “Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1200/ (accessed 3 November 2026)
  3. MITRE ATT&CK, “Limit Hardware Installation, Mitigation M1034 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/mitigations/M1034/ (accessed 3 November 2026)
  4. MITRE ATT&CK, “Exfiltration Over Physical Medium, Technique T1052 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1052/ (accessed 3 November 2026)
  5. CISA, “Avoiding Social Engineering and Phishing Attacks | CISA”, 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026)
  6. NCSC (UK), “Phishing attacks: defending your organisation”, 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026)

Cite this article

Brain, “Juice jacking and public USB chargers”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/juice-jacking-public-usb-charging/

BibTeX 
@misc{brain_cp026_en_2026,
  author = {Brain},
  title = {Juice jacking and public USB chargers},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/juice-jacking-public-usb-charging/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence