PoisonTap is a USB device that presents itself as a network adapter to intercept traffic and influence browser sessions on an unlocked machine. Attackers use it to capture cookies, manipulate web requests, or persist access through a physical port. Defenders should lock screens, restrict USB networking, and control untrusted devices on endpoints.
What PoisonTap Means in Practice
PoisonTap is not just a malicious USB gadget, it is a physical attack method that turns an unlocked workstation into a network interception point. By presenting as a network adapter, it can influence browser traffic and abuse the trust the operating system places in newly attached hardware.
The important security idea is that the device does not need to “break” the browser in the traditional sense. It exploits a moment of local access, then uses the operating system and browser’s own networking behaviour to reach cookies, session state, and requests that would otherwise be protected by normal remote-access controls.
How the Attack Works
The attack path depends on the endpoint accepting the USB device as a legitimate interface. Once the host routes traffic through it, the attacker can observe or manipulate web sessions that already exist on the machine, especially if the user has left the screen unlocked.
That makes the threat especially effective against browsers and web applications that rely on authenticated sessions rather than repeated credential entry. If session cookies are exposed, the attacker may not need the password at all. The browser can become the weakest link because it is already logged in and actively trusted by the user.
Why Browsers and Sessions Are the Main Target
PoisonTap is dangerous because browser sessions often represent real business access, not just convenience. Mail, internal dashboards, cloud consoles, ticketing systems, and admin panels are all reachable if the session is alive and the workstation is open.
Once an attacker can manipulate requests, the risk is not limited to passive sniffing. They may be able to trigger actions in the victim’s authenticated context, plant persistent access paths, or stage follow-on abuse through the same browser trust relationship. That is why session protection matters as much as endpoint hardening.
For broader endpoint context, the attack sits alongside other workstation abuse patterns covered in Endpoint Security Guide, where telemetry, hardening, and host controls are the baseline response to local compromise paths.
Defensive Controls That Matter Most
The most effective countermeasure is simple but operationally strict: prevent unlocked machines from becoming trusted attack surfaces. Screen locking, fast session timeouts, and user awareness reduce the window in which a device like PoisonTap can be attached and used.
Endpoint policy should also restrict USB networking and other untrusted USB functions, not just storage devices. Many environments focus on flash drives and overlook network-capable USB adapters, which creates a blind spot. Device control, allowlisting, and endpoint policy enforcement are the right control family here, especially where users work with sensitive web sessions.
The same principle is central to Removable Media and USB Control Guide, which covers USB blocking, allowlisting, and device-control policy for USB-borne threats.
Risk and Threat Considerations
PoisonTap is risky because it converts a brief moment of physical access into session theft, request manipulation, and possible persistence on an endpoint that was otherwise already authenticated. The danger is highest where users stay logged in to sensitive web apps and endpoint controls treat new USB hardware as low-risk by default.
Failure mechanism: The device abuses the host’s willingness to trust a newly attached network interface, then leverages active browser sessions to intercept or shape traffic without knowing the user’s password.
Impact: Attackers can steal cookies, hijack authenticated sessions, issue actions in the victim’s browser context, and extend access through a physical foothold that may survive the original intrusion window.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | PoisonTap is blocked by hardened endpoint and device configuration. |
| CIS-12 — Network Infrastructure Management | The attack abuses network trust at the host edge and local interface layer. | |
| Recommendation — Harden endpoints to restrict untrusted USB networking and enforce lock-screen behavior. Limit unauthorized network interfaces and monitor endpoint network changes. | ||
| NIST SP 800-53 Rev 5 | AC-19 — Access Control for Mobile Devices | USB-attached network devices create a mobile-device-style endpoint trust issue. |
| IA-5 — Authenticator Management | Session and cookie abuse makes credential and authenticator lifecycle protection material. | |
| SI-4 — System Monitoring | Detection requires visibility into endpoint interface changes and suspicious traffic paths. | |
| Recommendation — Restrict external device capabilities that can alter or expose endpoint traffic. Reduce session exposure by managing authenticator material and renewal practices carefully. Monitor for unauthorized USB network interfaces and unusual browser-session traffic. | ||
Practitioner Guidance
What to watch for: Treat any endpoint that can accept arbitrary USB networking as exposed to a local trust-abuse problem, not just a removable-media problem. Browser session risk, not only device risk, should drive policy decisions for shared workstations, admin endpoints, and high-value user devices.
Governance implication: Align endpoint policy so that USB networking, screen-lock enforcement, and untrusted device handling are owned as a single control area. That is the practical way to reduce the gap between physical access and browser-session compromise.
Related resources from NHI Mgmt Group
- What breaks when organisations rely only on USB blocking for device security?
- Who is accountable when CUI is moved to an unencrypted or unauthorised USB device?
- How should security teams detect USB exfiltration without relying on network traffic?
- Why do network device credentials need NHI governance?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org