Think That USB Port's JUST FOR CHARGING? Think Again.

Low battery. No outlet. That public USB port looks like a lifeline-but it could be a hacker's keyboard in disguise. Enter choicejacking-a next-generation cyberattack that hijacks our phone without permission. No taps. No clues. Just stolen access. If we care about our data, we must not plug in until we know what that charger is really doing.

- AKANKSHA SONDHI GAUR

Ever used a public charging station at an airport, coffee shop, or hotel? We have all been there—low battery, no outlet in sight, and that USB port seems like a lifeline. But what if that innocent-looking charger could hijack our phone—in less time than it takes to blink?

Welcome to the world of choicejacking—a stealthy, next-generation cyberattack that has security researchers sounding alarms. Unlike old-school juice jacking that required us to click something or fall for a fake app, choicejacking needs nothing from us at all. That is what makes it so dangerous. Let us unpack what it is, how it works, and why—if we care about our data—we should never trust a public USB port again.

What exactly is choicejacking

Let us start with a scenario. We plug our phone into a free USB port to charge. Normally, a prompt appears: “Allow this device to access your data?” We tap No and remain safe. With choicejacking, that prompt flashes for a microsecond—and the charger has already tapped Yes. Silent access in under 133 milliseconds—faster than our eyes can blink.

Choicejacking is the latest evolution in USB-based cyberattacks, discovered by a team of researchers from Graz University of Technology in Austria. Unlike earlier attacks that required malware or questionable apps, this one spoofs our own inputs—sending fake touch or keyboard commands to trick our phone into thinking we gave permission. The charger pretends to be us. This new kind of cyberattack exploits human interface device (HID) emulation—the same USB protocols we use daily to test hardware or connect peripherals are being turned against us.

Under the hood: How the attack works

When we plug into a malicious charger, we are not just drawing power. That charger can double up as:

• A USB host

• A spoofed keyboard or touchscreen (HID)

• A seemingly harmless power source