USB devices can put your PC at risk: experts warn against unknown drives

Security experts are warning that plugging random or unnecessary USB devices into your PC, just because a port happens to be open, can create real problems. A free port isn’t an invitation. One unknown device can expose a machine to malware, open the door to data theft, or, in some cases, even damage the hardware itself.

USB Disk Security Download

Recent threat research and industry forecasts show that removable media and public USB ports are still common ways in. By 2026, 51% of malware attacks are expected to target USB, up from 9% in 2019. Another finding: 52% of cyber threats are designed to spread through portable media, and 48% of people still plug in drives they find. Mandiant also reported that infected-USB attacks tripled in 2023. That included SOGU, SNOWYDRIVE, and PlugX campaigns tied to China-aligned espionage efforts aimed at government, healthcare, transportation, and other sectors across several regions.

And it isn’t only about flash drives. The Federal Bureau of Investigation (FBI), Federal Communications Commission (FCC), and Transportation Security Administration (TSA) have all warned about public charging attacks known as “juice jacking.” Security researchers have also documented newer “choice jacking” methods that can get around the prompts people expect to see, along with “USB killer” devices built to wreck hardware by dumping high-voltage surges into it.

The numbers are just as ugly in industrial and operational technology settings. Industrial threat telemetry shows that 51% of detected malware can spread through USB, which is nearly six times the 2019 level, and 82% of that malware can interrupt or shut down operations.

If you use USB drives or public charging a lot, take the warning seriously. Don’t plug in drives you find. Turn off Autorun, scan removable media, lock down ports that aren’t being used, train employees, and use the USB Implementers Forum (USB-IF) Type-C Authentication Program. CISA and the other agencies have published that guidance online.