Dropping BadUSB Keystrokes on macOS Before They Open Spotlight

A Japanese version of this story exists on Note. A Japanese journalist witnessed a live demonstration of a physical USB cable that masquerades as a charging port but covertly injects keystrokes at breakneck speed. As soon as this malicious device is plugged into a Mac computer, the embedded microcontroller registers the peripheral as a virtual keyboard and begins hammering out commands at more than 1,000 words per minute.

Even before the victim can react, the Spotlight search window flickers for a split second, Terminal opens, and a one-line command payload is executed. This whole breach unfolds in less than half a second—no files to download, no browser prompts, just an innocent-looking USB cable. While working on RoamSwitch, a lightweight macOS security tool, the reporter realized that traditional network defenses are insufficient if attackers can gain physical access to a system.

To protect against these kinds of attacks, the author created a Swift program to quarantine and block any unauthorized USB keyboards before they can send input to the operating system. Windows users have a built-in prompt asking if they want to allow the device, but Apple's approach doesn't work as well for Macs. When a BadUSB cable is connected, macOS trusts the device almost immediately and allows the keystrokes to pass through.

The reporter's solution takes advantage of two existing macOS subsystems: IOHIDManager, which monitors the hardware topology of connected devices, and CGEventTap, which filters keyboard events in real time using Accessibility permissions. Once a new USB keyboard is detected and not on an approved whitelist, the program immediately blocks all key events, preventing the attacker's keystrokes from reaching Spotlight, Terminal or any other application.