Attackers use juice jacking by compromising public charging stations or cables to deliver malware or steal data during charging. The threat depends on whether the device exposes data over the USB connection. Defenders should prefer AC-only charging, use charge-only cables or data blockers, disable data transfer on untrusted ports, and avoid unknown public chargers.
How attackers turn charging into a delivery path
juice jacking works when the charger is not just supplying power, but also exposing a data path over USB. Attackers take advantage of that dual-purpose connection by compromising a public charging point, altering a cable, or inserting malware-capable hardware between the outlet and the device. The objective is usually to abuse trust in a normal charging action, not to break into the phone through a visible prompt.
For the attack to succeed, the victim device must allow some form of data negotiation or accessory communication over the connection. If the port is power-only, the attack surface drops sharply. That is why the practical question is not whether a charger looks legitimate, but whether the connection can carry data as well as electricity.
One useful way to think about the technique is that the attacker is exploiting the charging ecosystem, not the battery itself. The moment a public USB port or cable becomes part of the trust boundary, the attacker can try to inject malicious payloads, harvest data, or trigger a prompt that leads the user into granting access they did not intend to give.
What attackers are trying to achieve
The two main outcomes are malware delivery and data theft. On a device that accepts data over USB, an attacker may try to load a malicious app, implant, or profile, or attempt to siphon files, device identifiers, or other information made available by the operating system. The exact result depends on the platform, the user’s settings, and how the USB connection is handled.
This is why public charging infrastructure matters more than many people assume. A convenience service can become a malicious interface when the underlying USB mode is permissive. The attack is often opportunistic, but it can still be effective because many users treat charging as a low-risk activity and do not inspect the port, cable, or prompt state carefully.
Attackers also benefit from the fact that charging happens in places where people are distracted: airports, hotels, transit hubs, conference venues, and retail locations. That environment makes it easier to hide a compromised charger among legitimate ones and harder for a user to distinguish benign charging from a tampered connection.
How to reduce exposure without losing the convenience of charging
The safest pattern is to separate power from data. Use AC-only charging where possible, choose charge-only cables or a data blocker when you must use unfamiliar infrastructure, and disable data transfer or accessory access on untrusted ports. That does not eliminate every risk, but it removes the attacker’s easiest path: a USB connection that can both power and talk to the device.
Devices and operating systems vary in how they ask for USB trust decisions, so the control that matters most is user behaviour at the moment of connection. A charger should be treated like any other unknown interface: if you do not know who owns it, assume it may attempt more than charging. For broader mobile threat context, see Mobile Malware Guide.
When organisations want a simple user rule, the best one is usually the least ambiguous one: if you need public power, bring your own wall adapter or a power bank. The more a user depends on shared USB infrastructure, the more the organisation must rely on device settings, awareness, and physical trust in places it does not control.
Risk and Threat Considerations
Juice jacking is a trust-boundary problem as much as a charging problem. The risk rises when users assume that every public USB port is power-only, or when mobile policy allows data access too readily on first contact. In those cases, the attacker does not need a sophisticated exploit chain, only a connection that the device will treat as more than electricity.
Failure mechanism: A compromised port, cable, or intermediary device presents itself as a normal charger while also offering a data channel, letting the attacker abuse USB trust, trigger a malicious prompt, or access data exposed by the device.
Impact: The result can range from malware installation or profile abuse to leakage of files, device information, or other data available through the USB session, especially where users approve access without recognising the risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1105 — Ingress Tool Transfer | Charging-port abuse may deliver malware onto a device over a data-capable USB link. |
| T1056 — Input Capture | Juice jacking can coerce a user into accepting prompts that expose data or enable compromise. | |
| Recommendation — Detect and block suspicious file transfer activity over external USB connections. Harden user-facing prompts and monitor for abuse of trusted input paths. | ||
| OWASP API Security Top 10 | API8 — Security Misconfiguration | The issue depends on unsafe USB/data configuration that exposes an unintended data channel. |
| Recommendation — Disable data transfer over untrusted ports and enforce safe device connection defaults. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Safe charging behavior depends on configuring devices to avoid risky USB data exposure. |
| Recommendation — Set devices to charge-only or least-trust USB modes by default. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest is protected | Reducing USB data exposure helps prevent unauthorized data access during charging. |
| Recommendation — Limit data exposure on untrusted charging connections. | ||
Practitioner Guidance
What to prioritise: Treat public charging exposure as a physical and endpoint trust issue, not just a convenience issue. The most effective control is to remove the data path first, then rely on user choice only as a backup.
What to verify: Confirm that managed devices default to charging-only behaviour or prompt conservatively for USB access, and make sure users know how to reject data transfer on untrusted ports. If the device cannot reliably enforce that stance, compensate with charge-only cables or a blocker.
Common mistake: Assuming that a normal-looking USB outlet is safe because it is in a public venue. A clean-looking port can still be a hostile interface if it negotiates data alongside power.
Practitioner takeaway: The practical defence against juice jacking is to break the data channel, because once the USB path can carry data, the attacker’s job becomes much easier than most users assume.
Related resources from NHI Mgmt Group
- Why do passwords remain dangerous when attackers use AI to find vulnerabilities?
- How should security teams reduce fraud when attackers use deepfakes and synthetic identities?
- How should security teams handle exposed cloud keys before attackers use them?
- How should organisations reduce business email compromise risk when attackers use generative AI?