Every day, millions of travelers plug their phones into free USB charging stations at airport gates without a second thought. It feels harmless, even smart. Your battery is dying, your boarding pass is on your phone, and there’s a convenient port right there.
The Threat Has a Name: Juice Jacking
Juice jacking is a cyberattack that uses a compromised USB charging port or cable to infect a phone, tablet, or computer with malware or steal data while the device is charging. The concept sounds like something from a spy thriller, but it has been a recognized security concern for well over a decade. Juice jacking is a cyberattack that leverages the dual functionality of USB ports. While USB cables deliver power to recharge a device, they also transmit data. Cybercriminals exploit this dual purpose by tampering with public charging stations or cables to install malware onto a device or surreptitiously extract sensitive data.
On March 5, 2025, the U.S. Transportation Security Administration (TSA) posted a public service announcement on its verified Facebook account warning that “Hackers can install malware at USB ports.” The TSA announcement included a reminder about email and social media scams, as well as the dangers of using free public Wi-Fi. This is not the first time a federal body has issued such a warning. The FBI has been issuing warnings against the use of public charging stations since 2023, and the Federal Communications Commission (FCC) has labeled juice jacking as a “new form of cyber theft,” urging the public to remain cautious.
What Hackers Can Actually Do to Your Device
Once malware is installed, attackers can gain unauthorized access to emails, credentials, and financial information; they can even deploy ransomware. The scary part is how invisible this process can be. As Matt Swinder, editor-in-chief and founder of TheShortcut.com, told CBS News, “The scary part of juice jacking is that you probably won’t even be able to tell that your phone is infected with malware after plugging it into a compromised USB port.” Beyond device locking, the implications stretch much further. Malicious software can steal or delete data from your phone and possibly spy on your usage activity, to the extent of transmitting your personal information such as account numbers, usernames, passwords, photos, and emails to the perpetrator.
For individuals, juice jacking can mean identity theft, stolen data, and compromised accounts. For businesses, the stakes are even higher. If an employee unknowingly connects a work device to a compromised charging station, attackers may gain a potential foothold into corporate systems. This can trigger data incidents, regulatory investigations, and significant reputational harm. According to an IBM publication, 79% of business travelers unknowingly risk exposure to attacks by using public USB ports or charging stations. That is a staggering proportion of the very people who travel most frequently through international airports.
ChoiceJacking: The 2025 Research That Changed Everything
For years, both Apple and Google incorporated user-consent prompts into their operating systems, requiring travelers to physically approve a data connection before any transfer could occur. Researchers assumed this made juice jacking largely impractical. Then in 2025, a team from Austria turned that assumption on its head. Cybersecurity researchers from Graz University of Technology in Austria unveiled a novel attack technique called ChoiceJacking, which tricks smartphones into enabling USB data transfer without user consent, bypassing protections originally designed to prevent juice jacking attacks. By simply plugging a phone into a compromised public charger or USB cable embedded with this attack system, the phone is deceived into believing the user has manually approved data transfer – even though the user never touched the screen. The attack takes just 133 milliseconds, faster than the blink of an eye.
The evaluation using a custom malicious charger design reveals an alarming state of USB security on mobile platforms. Despite vendor customizations in USB stacks, ChoiceJacking attacks gain access to sensitive user files – pictures, documents, app data – on all tested devices from 8 vendors, including the top 6 by market share. The researchers responsibly disclosed all findings to affected vendors. All but one, including Google, Samsung, Xiaomi, and Apple, acknowledged the attacks and are in the process of integrating mitigations. The research was formally presented at the 34th USENIX Security Symposium in August 2025, one of the most prestigious cybersecurity conferences in the world.
The USB Threat Landscape Is Growing Fast
According to 2024 data from Honeywell’s USB Threat Report, 51% of malware attacks are designed for USB devices – a nearly six-fold increase from 9% reported in the 2019 report. This dramatic rise reflects a broader trend of cybercriminals shifting attention toward physical attack vectors that are easy to overlook. Many attackers are using USB devices to establish silent residency in industrial control systems. Instead of simply exploiting vulnerabilities, many intruders hide and observe operations for some time before launching attacks that leverage the inherent capabilities of the systems.
As of 2024 and 2025, numerous domestic and international cases have been reported involving the distribution of cryptocurrency mining malware via USB devices. The threat has also evolved technically. BadUSB refers to an attack method that alters the firmware of a USB device to make it appear as a regular storage device while performing malicious functions in the background. These attacks are particularly dangerous because they are difficult to detect with standard antivirus software and are recognized as trusted devices by operating systems. Travelers carrying sensitive personal or work data are especially appealing targets.
Airport Wi-Fi Is Just as Dangerous – Maybe More So
The USB charging port is not the only threat lurking in airport terminals. The free Wi-Fi can be equally dangerous. Internet “evil twins” are stalking airport Wi-Fi connections, and the cybercriminals behind these rising attacks are rarely caught. What cybersecurity experts refer to as “evil twin” attacks are on the rise, targeting public Wi-Fi in airports or coffee shops. The miniaturization of the digital twinning technology has made this kind of cyberattack more appealing to hackers, with the technology to pull it off available for less than $500. A real-world case made international headlines in 2024. The Australian Federal Police charged a 42-year-old man who allegedly established fake free WiFi access points, which mimicked legitimate networks, to capture personal data from unsuspecting victims who mistakenly connected to them.
Matt Radolec, vice president of incident response and cloud operations at data security firm Varonis, said “as the general population becomes more accustomed to free Wi-Fi everywhere, you can expect evil twinning attacks to become more common,” adding that no one reads the terms and conditions or checks the URLs on free Wi-Fi. Even worse, 45% of respondents admitted to making financial transactions via public Wi-Fi, and 47% failed to verify the legitimacy of Wi-Fi hotspots. Both threats – USB and Wi-Fi – tend to converge in the same physical space: the airport departure lounge.
How to Protect Yourself Before Your Next Flight
The good news is that protection is straightforward and requires no special technical knowledge. Like the FBI, the FCC recommends that travelers avoid using a public USB charging station and instead use a power outlet. Travelers should carry a portable charger or external battery. If you must use a public USB port, one simple accessory makes a significant difference. People can be careful by using a USB data blocker, a small dongle that adds a layer of protection between a device and the charging point – or as they are unofficially known, “USB condoms.” These cost just a few dollars and are widely available online.
In 2025, both Apple and Google made updates that now require biometric authentication or PIN entry – not just a simple “yes” tap – for USB data transfers. This update applies to iOS 18.4 and Android 15. That said, certain Samsung models running One UI 7 do not require secure confirmation, leaving them vulnerable to ChoiceJacking. If you bring a portable power bank, be sure to pack it in your carry-on bag. The FAA prohibits lithium-ion batteries from being stored in checked luggage or overhead bins because they can overheat or catch fire. Updating your phone’s operating system to the latest version, locking your screen while charging, and relying on your own wall adapter whenever possible remain the most effective and immediately actionable steps any traveler can take.
