It looks exactly like a regular flash drive.
but it's not.
When you plug in a normal USB drive, your computer mounts it as storage but when you plug in a Rubber Ducky, your computer registers it as a keyboard.
keyboards are trusted by default so no antivirus scan.
The Ducky immediately starts typing a preloaded script at up to 1,000 words per minute. faster than any human.
In seconds it opens:
— opens a hidden PowerShell window
— downloads a reverse shell
— creates a backdoor account
— exfiltrates saved passwords
— installs persistent malware
DuckyScript 3.0 made it worse. the payload now detects which OS it's on Windows, macOS, Linux and adapts automatically.
in 2026 red teams are documenting multi-vector attacks: one person plants the Ducky while an accomplice calls the IT helpdesk pretending to be a vendor. distraction and compromise simultaneously.
Ever heard of a USB Rubber Ducky?