CYBERSECURITY MONTH 2026
USB drop attack
Simulate field risks around removable media: found USB keys, trapped devices, plug-in reflexes and reporting.
- email, mobile, field and voice
- Multi-channel
- based on observed behavior
- Retargeting
- contextual pages and feedback
- Education
email, mobile, field and voice
based on observed behavior
contextual pages and feedback
What kinds of USB sticks are there?
USB phishing, also called a USB drop attack, is a technique used to get into or compromise an organisation's network. The attacker leaves sticks in strategic places: the company car park, the entrance hall, the break room. They are counting on curiosity, and curiosity is enough.
Three families circulate. The classic stick, carrying a malicious file and waiting to be opened. The stick that emulates a keyboard, known as HID spoofing or a Rubber Ducky, which types its own commands the moment it is plugged in, with no file opened at all. And the USB Killer, which physically destroys the components of whatever device it is connected to.
The sticks we use for campaigns are not ordinary USB drives: they emulate a keyboard, like the real ones. You choose whether they carry an empty file or an awareness page.
Put your teams in real conditions
Order online the number of sticks you need. Our teams configure them so they are tied to your campaign and ship them discreetly. You leave them in plain sight in a shared space where the people concerned pass through, or you post them to specific employees. The statistics then reach your dashboard in real time.
- Sticks configured and tied to your campaign
- Shipped discreetly by courier
- Dropped in shared spaces or posted to targets
- Anonymised reporting, or enriched if you prefer
Sticks configured and tied to your campaignWhat the campaign helps you test
Scenario
Assess behavior when unknown media is found on premises.
Targeting
Raise awareness about classic USB keys, HID devices and information-collection scenarios.
Reporting
Train users to report and handle suspicious media properly.
Analysis
Feed results into field campaigns and Learning Academy remediation.
Deploy with minimal friction
- ScopingSites, safety rules, messages and simulation level.
- DeploymentIdentified media, traceability and intervention guidelines.
- MeasureReports, plug-ins and observable behaviors.
- DebriefEducational restitution and targeted remediation actions.
Frequently asked questions
- Why raise awareness across the whole workforce?
- Because a single stick plugged in is enough. Collective awareness heads off attacks, installs the right reflex, never plug in a device you found, and cuts the risk of infection during a real attempt.
- How much detail comes back in the statistics?
- That is your choice. Either simple, anonymised reporting of the stick being connected or the file being opened, or enriched reporting with additional data such as hostname, Windows user or IP address.
- Where should the sticks be left?
- Where an attacker would leave them: the car park, the reception hall, the break room, around the offices. Sticks can also be posted to employees, which reproduces an increasingly common scenario.
- Can the sticks be reused?
- Yes, they stay with you and can serve later campaigns. That is what makes this format economical once the first batch is ordered.
- Is the solution GDPR compliant?
- We apply a personal data protection policy in line with GDPR principles. Privacy impact assessments are carried out regularly to maintain a high level of data security day to day. Our AFNOR-certified DPO oversees ongoing compliance, in particular data minimisation and respect for individual rights.
Build a campaign around your real exposure
BlueSecure can combine this channel with the other Phishing 360 channels depending on your risk profile: email, SMS, QR code, USB, physical mail, physical intrusion, vishing and voice deepfake.