{
  "id": 4681085,
  "title": "Dropping BadUSB Keystrokes on macOS Before They Open Spotlight",
  "url": "https://urgent.news/2026/08/31/dropping-badusb-keystrokes-on-macos-before-they-open-spotlight",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-31T16:55:42.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/lafine_systemsdesign/dropping-badusb-keystrokes-on-macos-before-they-open-spotlight-3of8"
  },
  "original_language": "en",
  "account": "A Japanese version of this story exists on Note. A Japanese journalist witnessed a live demonstration of a physical USB cable that masquerades as a charging port but covertly injects keystrokes at breakneck speed. As soon as this malicious device is plugged into a Mac computer, the embedded microcontroller registers the peripheral as a virtual keyboard and begins hammering out commands at more than 1,000 words per minute. Even before the victim can react, the Spotlight search window flickers for a split second, Terminal opens, and a one-line command payload is executed. This whole breach unfolds in less than half a second—no files to download, no browser prompts, just an innocent-looking USB cable. While working on RoamSwitch, a lightweight macOS security tool, the reporter realized that traditional network defenses are insufficient if attackers can gain physical access to a system. To protect against these kinds of attacks, the author created a Swift program to quarantine and block any unauthorized USB keyboards before they can send input to the operating system. Windows users have a built-in prompt asking if they want to allow the device, but Apple's approach doesn't work as well for Macs. When a BadUSB cable is connected, macOS trusts the device almost immediately and allows the keystrokes to pass through. The reporter's solution takes advantage of two existing macOS subsystems: IOHIDManager, which monitors the hardware topology of connected devices, and CGEventTap, which filters keyboard events in real time using Accessibility permissions. Once a new USB keyboard is detected and not on an approved whitelist, the program immediately blocks all key events, preventing the attacker's keystrokes from reaching Spotlight, Terminal or any other application.",
  "summary": "A Japanese version of this is on Note . A few weeks ago, I watched a demonstration of an OMG Cable attacking a Mac. If you haven't seen one in person, it is genuinely unnerving. The cable looks 100% identical to a standard braided USB-C charging cord. It charges an iPhone normally. But the instant you plug it into a laptop, an embedded microcontroller registers as a virtual USB keyboard and…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}