Juice Jacking

Juice jacking is a charging-port attack where a compromised public USB power point or cable attempts to steal data or deliver malicious commands to a connected device. The practical defence is to charge from trusted power-only sources, use a personal charger or power bank, and block data transfer when connecting to unfamiliar ports.

What Makes Juice Jacking Dangerous

Juice jacking works because many people treat public charging points as harmless utilities, even though a compromised USB port or cable can behave like a small attack surface. The risk is not power delivery itself, but the data-capable path that can be abused when a device negotiates a USB connection.

That makes the threat especially relevant in transit hubs, hotels, conferences and any place where a device may be left unattended while charging. The attacker’s goal is usually to gain a brief foothold through trust in shared infrastructure, rather than to visibly compromise the charger.

How the Attack Path Works

A malicious charging station can impersonate a normal USB accessory, prompt the device to expose data functions, or try to deliver commands while the user only expects charging. In the most basic case, the port attempts to access files, contacts or other device data once the USB relationship is established.

Some attacks depend on the victim accepting an unexpected prompt or on a device automatically trusting a new accessory. Others rely on users plugging into a cable that is physically modified to carry both charging and data signals. The shared pattern is that the charging interface becomes a bridge for something more than electricity.

For mobile devices, the danger is closely related to broader USB-based compromise patterns seen in mobile malware. NHIMG’s Mobile Malware Guide is useful background for understanding how attackers abuse mobile trust boundaries and device interaction paths.

Defensive Controls and Safe Charging Practices

The safest practical approach is to prefer trusted power-only sources, such as a wall adapter, a personal charger, or a power bank. If a public port must be used, devices should be configured so they do not expose data transfer by default, and users should avoid approving any unfamiliar USB accessory prompt.

For organisations, the important control is to reduce reliance on unknown charging infrastructure and to make safe charging the default behaviour for managed devices. That includes user guidance, device policy settings, and travel practices that remove the need to trust public USB ports in the first place.

Public-facing charging risk also fits a larger access-control mindset: if a connection is not needed for data exchange, the device should not grant it. The NIST Zero Trust Architecture view of minimizing implicit trust is a useful lens here, and the NIST SP 800-207 Zero Trust Architecture provides that baseline principle.

Signs of Exposure and Post-Connection Review

Exposure is often difficult to prove because a successful juice jacking attempt may be brief and quiet. Warning signs can include unexpected USB prompts, unusual accessory names, unexplained device behavior after charging, or a device that asked for data access when only charging should have been needed.

If a device was connected to an untrusted port and the user later suspects compromise, the practical review should focus on whether any trust decision was made during that session and whether the device was asked to share data. Where business data or managed accounts may be involved, the safer assumption is to inspect the device and the accounts it can access before treating the event as harmless.

Related resources from NHI Mgmt Group

• Why do Juice Shop-style benchmarks create misleading confidence?
• How should organisations reduce contractor jacking in digital onboarding and login workflows?
• Why do traditional network firewalls and application controls fail against prompt injection and context-jacking?
• How should security teams reduce repo jacking risk in dependency pipelines?