Credential theft via USB devices: how it works and how to protect yourself

Originally published in 2013 when this blog covered offensive tutorials; rewritten in 2026 with a defensive focus.

The original version of this post was a step-by-step guide to building a USB "rootkit" that silently harvested stored passwords from any Windows computer it was plugged into. Those instructions have been removed. What remains — and what matters — is understanding the threat at a high level so you can defend against it. USB-based credential theft is a real, low-tech attack that still works today in offices, schools, and anywhere strangers have physical access to machines.

How the attack works, at a high level

The concept is simple and requires only brief physical access. An attacker prepares a USB drive with malicious software designed to run when the drive is inserted — historically via the Windows autorun mechanism, today more often through social-engineering tricks that get the victim to click something, or through devices that disguise themselves as keyboards. Once running, the software reads credentials that applications have saved on the machine: browser-stored passwords, saved logins in email and messaging clients, and other cached secrets. The results are written back to the drive, and the attacker walks away with them in seconds.

Two things make this attack potent. First, it needs no network access and leaves little obvious trace to the casual user. Second, many people store passwords in their browsers or stay logged in on shared and work computers, so there is usually something worth stealing.

What defenders and IT teams should watch for

• Removable-media telemetry: endpoint logs showing USB insertions, especially unknown devices on sensitive machines, followed by unexpected process launches from the removable drive.
• Antivirus/EDR detections flagging credential-access tools or suspicious executables running from USB paths.
• Physical indicators: unknown USB drives left in parking lots or desks — a classic social-engineering lure counting on curiosity.
• Policy violations: users plugging personal drives into locked-down workstations.

Protecting yourself and your organization

• Disable autorun/autoplay for removable media via Group Policy or device management — this closes the classic silent-execution path. (Modern Windows versions already restrict it, but verify the setting.)
• Use endpoint device-control policies to restrict or require approval for USB storage devices, especially on sensitive systems. Consider allowing only approved, encrypted drives.
• Don't let browsers save passwords on shared or work machines — and clear any that are already saved. Store credentials in a reputable, encrypted password manager protected by a strong master password and multi-factor authentication.
• Enable multi-factor authentication everywhere it matters. Even if a password is stolen, MFA stops the attacker from using it.
• Lock your screen whenever you step away, and treat physical access as a security boundary: don't leave machines unattended in public areas.
• Never plug in a USB drive you didn't expect — not found drives, not gifted ones, not drives handed to you by strangers.
• Keep EDR/antivirus active and updated, and never disable it at someone else's instruction.

If a suspicious USB was plugged in

Disconnect it, do not investigate it on a production machine, and report it to your IT or security team. Assume credentials on that machine may be compromised: change important passwords from a known-clean device, review account activity for unfamiliar logins, and let incident response determine the scope.

Authorization reminder

Security testing involving other people's systems or credentials must only be done with explicit authorization. Building or deploying credential-harvesting tools against systems you don't own is illegal in most jurisdictions — no exceptions for curiosity or "just testing."

How Metasploit-based attacks work — and how to protect your endpoints

Originally published in 2013 when this blog covered offensive tutorials; rewritten in 2026 with a defensive focus.

The Metasploit Framework is a legitimate, widely used penetration-testing platform maintained by Rapid7. Security professionals use it — with authorization — to verify that defenses actually work. But the same framework is routinely repurposed by attackers, and understanding its attack chain at a high level is exactly what defenders need to build protections that hold up against it. This rewrite describes the attack only at the level of abstraction useful for defense: what the attacker is trying to achieve, what your telemetry should show, and how to stop it.

The anatomy of a Metasploit-based attack

A typical endpoint compromise follows a familiar chain. First, the attacker sets up infrastructure that serves exploit code — often a web page hosting browser or plugin exploits. Second, the victim is lured to that page, usually through phishing: a convincing email, message, or ad. Third, if the victim's browser or a plugin has an unpatched vulnerability, the exploit code runs and delivers a payload — a small program whose job is to connect back to the attacker and hand over control of the machine.

From the defender's perspective, the details of any single exploit module matter less than the pattern: unpatched software + social engineering + a callback to attacker infrastructure = compromise. Defenses that break any link in that chain defeat the attack regardless of which module is used.

What your telemetry should show

Modern endpoint and network monitoring can catch this attack chain at multiple stages. Look for:

• Phishing delivery: suspicious links or attachments in email, flagged by your email security gateway; users reporting unexpected messages.
• Exploitation: browser or application crashes followed by unusual child processes, process injection into legitimate applications, or memory-protection alerts from EDR.
• Callback (command and control): new outbound connections to unknown hosts on unusual ports, beaconing patterns (regular intervals), or DNS requests to recently registered domains.
• Post-exploitation: credential dumping attempts, lateral movement to other hosts, or disabled security tooling — all classic EDR alert categories.

The single most valuable investment here is a well-tuned EDR/XDR platform with alerts that someone actually reviews, backed by centralized logging so you can trace the chain end to end.

Hardening that defeats the attack chain

• Patch aggressively: operating systems, browsers, and plugins. Most Metasploit modules target known, patched vulnerabilities — timely patching removes the foothold entirely.
• Deploy EDR on every endpoint and keep it updated; pair it with application allowlisting on high-value systems.
• Practice least privilege: users should not run as local administrators day to day, which limits what a payload can do even if it lands.
• Filter email and web traffic: block malicious attachments and URLs before they reach users, and use DNS filtering to cut off callback infrastructure.
• Train users on phishing: the lures are the delivery mechanism; a workforce that reports suspicious messages shrinks the attack surface dramatically.
• Segment the network so a single compromised endpoint cannot reach everything else.

Testing your own defenses

If you want hands-on experience with these attack patterns, do it in an isolated lab: virtual machines you own, with no connection to production systems. Frameworks like Metasploit exist so defenders can validate that patching, EDR, and hardening actually stop real techniques — use them that way.

Authorization reminder

All security testing must only be performed on systems you own or are explicitly authorized to assess. Deploying exploit infrastructure or payloads against anyone else's systems without permission is illegal in most jurisdictions.