Juice jacking: how public USB chargers steal your data

You're at the airport, at the gate, phone battery on its last breath. Two meters ahead: a free USB charging station. Looks like luck. You plug in the cable. What happens over the next few minutes you don't see — but an attacker who prepared that outlet may be seeing all of it. That's juice jacking.

What is juice jacking?

The term was coined in 2011 by researcher Brian Krebs after a demonstration at DEF CON, the world's largest security conference. The premise is technical but straightforward: a USB connector doesn't only carry power — it carries data too. A compromised charging station or a tampered cable can do both at the same time, without you noticing.

The attack splits into two main variants:

• Data theft: the malicious outlet or cable copies files, contacts, photos and stored credentials from the device while the battery charges.
• Malware installation: the charger installs malicious software — a keylogger, spyware or a banking trojan — that keeps running after you unplug.

In practical terms, the attack vector can be delivered in three ways:

1. Modified public station — the internal hardware of a legitimate USB outlet is swapped for a version carrying an attack chip.
2. Malicious cable — ordinary-looking cables with extra circuitry embedded in the connector. The most studied model is the O.MG Cable, built specifically for pentesters and researchers.
3. Intermediate adapter — a tiny device sitting between your cable and the USB port that injects commands while the device charges.

ChoiceJacking: the technique that beats "Trust this device"

For years, Apple and Google answered juice jacking with a simple defense mechanism: on detecting a USB connection that tries to access data, the system shows a prompt — "Allow this device to access photos and videos?" or the Android equivalent. Declining blocks the data channel; accepting is required for legitimate transfers.

In 2025, researchers at Graz University of Technology (Austria) presented a technique called ChoiceJacking at the 34th USENIX Security Symposium that gets around exactly that prompt. The malicious charger disguises itself as a USB keyboard and simulates a tap on "Allow" before the user can react. In testing, the attack took 133 milliseconds — well below human reaction time.

The devices affected in the tests included Samsung, Xiaomi and Huawei models as well as Apple hardware. Kaspersky analyzed the study and confirmed the technique works under controlled lab conditions. iOS 18.4 and Android 15, released after the research was published, shipped specific fixes for the gaps ChoiceJacking exploited. Devices without those updates remain vulnerable to variations of the attack.

The FBI, FCC and TSA have issued alerts — but what's the real situation?

The FBI (Denver field office), the FCC and the US Transportation Security Administration (TSA) have all published warnings about juice jacking. The TSA issued a specific public advisory in March 2025 telling passengers to avoid USB ports in airports. The FBI and the FCC recommend using regular electrical outlets and your own charger.

It's important to be precise here: to date, there are no verified public records of large-scale juice jacking attacks in the real world. No documented incident of victims infected via a compromised USB outlet in an airport or mall has been independently confirmed. What exists is technical proof of viability — and ChoiceJacking raised the sophistication of that proof considerably.

The absence of confirmed cases doesn't mean zero risk. It means the attack isn't common yet — something that can change as the necessary tooling becomes more accessible to criminal groups. Security agencies prefer to warn before the vector becomes routine.

How to protect yourself in practice

• Use a conventional wall outlet — your original charger in a normal socket is the safest route. A public USB port, even a legitimate one, isn't worth the unnecessary risk.
• Charge from a power bank — a portable battery removes any dependence on an external port. It's the most practical protection for travel.
• Use a USB data blocker — see below for exactly what that is and how it works.
• Select "Charging only" — when the device asks which USB connection mode to use, pick the option that doesn't transfer data. On Android, this blocks the data channel in software.
• Keep the system updated — iOS 18.4 and Android 15 closed the gaps used in ChoiceJacking. Out-of-date devices are more exposed to variations of the attack.
• iPhone: turn on USB accessory locking — under Settings → Face ID & Passcode, enable the "USB Accessories" option. With it off, the iPhone blocks USB data when the device has been locked for more than an hour.

What is a USB data blocker?

A USB data blocker — also called a "USB condom" — is a physical adapter that sits between the cable and the charging port. It lets power through but physically disconnects the data pins, making any file transfer or software installation impossible.

They cost between US$8 and US$20 on marketplaces like Amazon and AliExpress. It's the most robust solution for anyone who needs to use public USB ports frequently: even if the outlet is compromised, all it can do is charge the device — nothing else gets through the connector.

Is juice jacking the only risk in public spaces?

Definitely not. Anyone operating in public places has more than one option. A mall Wi-Fi network that looks legitimate can be an evil twin attack — a fake network created to intercept all of your device's traffic with no physical hardware involved. QR codes pasted over the originals on restaurant tables or self-service terminals are the vector for quishing, a phishing variant that exploits our trust in QR codes. USB is one more channel — not the only one worth watching in those environments.

The practical rule holds across every vector: in public spaces, don't connect to hardware you don't control. Bring your own charger, your own cable and, if you need extra power, a power bank you've already charged. If you want to review Android's security settings beyond USB, the post on how to secure Android with 8 practical adjustments covers app permissions, screen lock and other settings that make a difference day to day.

A free USB outlet at an airport is convenience. Security is the charger you brought in your backpack.