HID Injection Malware in the Wild

What Is HID Injection?

HID (Human Interface Device) injection attacks exploit a fundamental trust relationship in computing: operating systems implicitly trust keyboard input. When a USB device identifies itself as a keyboard, the operating system accepts its input without question. There is no authentication step, no permission prompt, no user confirmation. The "keyboard" can type commands at machine speed, executing payloads in seconds.

A HID injection device looks like a USB flash drive, a charging cable, or any other innocuous USB peripheral. But internally, it contains a microcontroller programmed to emulate a keyboard. When plugged in, it types a pre-programmed sequence of keystrokes - opening a terminal, downloading malware, creating backdoor accounts, or exfiltrating data.

The attack is fast. A well-crafted payload can execute in under five seconds. By the time the victim notices anything unusual on screen, the damage is already done.

BadUSB at Black Hat 2014

The concept of USB-based attacks existed before 2014, but the BadUSB presentation by Karsten Nohl and Jakob Lell at Black Hat 2014 made the threat concrete and widely understood. They demonstrated that USB device firmware could be reprogrammed to change the device's identity and behavior.

graph TD
    subgraph "BadUSB Attack Concept"
        A[Normal USB Flash Drive] --> B[Reprogram Firmware]
        B --> C[Device Now Identifies as Keyboard]
        C --> D[Victim Plugs In Drive]
        D --> E[OS Recognizes HID Keyboard]
        E --> F[Payload Typed at Machine Speed]
        F --> G[Open Terminal/PowerShell]
        G --> H[Download and Execute Malware]
        H --> I[System Compromised]
    end

BadUSB attack flow - a reprogrammed flash drive becomes a keyboard that types malicious commands

A standard USB flash drive, they showed, could be reprogrammed to present itself as a keyboard while still functioning as storage. The victim plugs in what they believe is a borrowed flash drive. The drive mounts as expected, but simultaneously begins typing commands in the background. The victim may not even see the command window flash open and close.

The critical insight from BadUSB was that the vulnerability exists in the USB specification itself. The USB standard allows devices to change their device class after enumeration. There is no mechanism for the operating system to verify that a device claiming to be a keyboard is actually a physical keyboard. This is a design limitation, not a bug - and it cannot be patched without breaking USB compatibility.

FIN7 and the Best Buy Gift Cards

In 2020, the FBI and the US Postal Inspection Service warned organizations about a campaign by FIN7 (also known as Carbanak), a sophisticated cybercriminal group, that mailed BadUSB-equipped devices to targeted companies. The devices arrived disguised as promotional Best Buy gift cards.

The packages included a seemingly genuine Best Buy gift card and a USB drive labeled as containing a list of products the gift card could be used to purchase. When curious employees plugged in the drive, it executed a HID injection attack that installed a backdoor on the corporate machine.

graph TD
    subgraph "FIN7 USB Mail Attack"
        A[FIN7 Purchases BadUSB Devices] --> B[Packages Disguised as Best Buy Gift Cards]
        B --> C[Mailed to Target Companies via USPS]
        C --> D[Employee Receives Package]
        D --> E[Employee Plugs In USB Drive]
        E --> F[HID Payload Executes]
        F --> G[PowerShell Downloads Backdoor]
        G --> H[Backdoor Installs - GRIFFON/CARBANAK]
        H --> I[C2 Communication Established]
        I --> J[Lateral Movement and Data Theft]
    end

FIN7 USB mail campaign - physical social engineering combined with HID injection

The USB devices used in the campaign were commercially available development boards (reportedly Arduinos and Teensy boards) reprogrammed to act as keyboards. The payload opened PowerShell and executed a script that downloaded and installed FIN7's GRIFFON malware, establishing persistent command-and-control access.

FIN7 reportedly sent these packages to organizations in the hospitality, retail, and restaurant industries - sectors known for processing high volumes of payment card data. The campaign demonstrated that HID injection had moved from security conference demonstrations to active criminal operations.

The O.MG Cable

The O.MG cable, created by security researcher Mike Grover (MG), pushed HID injection into an even more covert form factor. The O.MG cable looks identical to a standard USB charging cable - Lightning, USB-C, or Micro-USB. But embedded inside the cable's connector is a WiFi-enabled microcontroller capable of HID injection, keystroke logging, and remote payload delivery.

When a target plugs in the O.MG cable to charge their phone or connect their device, the embedded hardware can inject keystrokes, capture typed passwords, and communicate with the attacker over WiFi. The cable even has a geofencing feature that can trigger payloads when the cable enters or leaves a specific GPS region.

The O.MG cable is sold as a legitimate penetration testing tool, but its existence demonstrates the threat: a charging cable borrowed from a colleague, left on a conference table, or provided by a hotel could be a weaponized device. Physical inspection cannot reliably distinguish an O.MG cable from a genuine one without specialized equipment.

USB Drop Attacks as Social Engineering

USB drop attacks combine HID injection with social engineering. The attacker leaves USB drives in locations where they are likely to be found by employees of the target organization - parking lots, lobbies, restrooms, and break rooms. Human curiosity drives the attack: studies have shown that 45-98% of dropped USB drives are plugged into computers, depending on the study and context.

A 2016 study by researchers at the University of Illinois dropped 297 USB drives around the campus. 48% were plugged in, with the first drive connected within six minutes. The researchers found that labeling drives with enticing labels ("Confidential" or "Final Exam Answers") increased the plug-in rate, but even unlabeled drives were frequently connected.

In authorized penetration tests, USB drop attacks consistently achieve initial access. The drives may contain HID injection payloads, autorun exploits (on older systems), or simply documents with tracking beacons that phone home when opened. The attack succeeds because it exploits human behavior rather than technical vulnerabilities.

Wireless HID With the BLEShark Nano

The BLEShark Nano includes a Bad-BT feature that operates as a wireless HID injection tool over Bluetooth. Unlike USB-based HID attacks that require physical access to a USB port, Bad-BT works wirelessly, injecting keystrokes over a Bluetooth connection.

For authorized penetration testing, this capability demonstrates the wireless HID attack surface. Bluetooth HID is used by wireless keyboards and mice, and devices that accept Bluetooth HID connections can be vulnerable to injection from unauthorized sources. The Nano allows security professionals to test whether target systems properly restrict Bluetooth HID pairing and whether endpoint protection tools detect automated keystroke injection.

The wireless nature of Bad-BT changes the physical access requirement. Traditional USB HID attacks require placing a device in a USB port, which means being physically present at the target machine. Bluetooth HID can potentially reach devices within radio range - typically 10-30 meters - without physical contact.

Pentest Tools in the Field

Several commercial and DIY tools have been developed for authorized HID injection testing. The Hak5 Rubber Ducky was one of the first dedicated HID injection platforms, providing a simple scripting language (DuckyScript) for creating keystroke payloads. The Bash Bunny extended this concept with network attack capabilities alongside HID injection.

These tools are standard equipment for penetration testing teams. During physical security assessments, testers may leave USB drops, plant modified cables, or attempt Bluetooth HID injection to evaluate an organization's vulnerability to these attack vectors. The results often demonstrate that technical security controls (firewalls, intrusion detection, endpoint protection) can be bypassed entirely by a single USB device or wireless connection that delivers keystrokes directly to the operating system.

Defense Measures

Defending against HID injection requires layered controls.

USB device control policies allow organizations to whitelist specific USB devices and block unauthorized HID devices. Group Policy on Windows can restrict which USB device classes are allowed. Third-party endpoint protection tools provide more granular control, including alerts when new HID devices are connected.

Physical security measures include USB port locks (physical blockers that prevent insertion), secure charging stations that provide power without data connectivity, and policies prohibiting the use of unknown USB devices.

User awareness training should specifically address USB drop attacks and the risks of connecting unknown devices. Employees should understand that a USB drive found in a parking lot is not a lucky find - it may be a targeted attack.

Endpoint detection and response (EDR) tools can detect the rapid keystroke patterns characteristic of HID injection. A keyboard that types 200 words per minute with zero errors and executes PowerShell commands is clearly not a human operator. Modern EDR solutions include specific detections for these patterns.