{"id":10601,"date":"2026-02-12T10:03:49","date_gmt":"2026-02-12T10:03:49","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/02\/12\/44-evilmouse-autonomously-executes-commands-and-compromises-systems-once-connected\/"},"modified":"2026-02-12T10:03:49","modified_gmt":"2026-02-12T10:03:49","slug":"44-evilmouse-autonomously-executes-commands-and-compromises-systems-once-connected","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/02\/12\/44-evilmouse-autonomously-executes-commands-and-compromises-systems-once-connected\/","title":{"rendered":"$44 Evilmouse Autonomously Executes Commands and Compromises Systems Once Connected"},"content":{"rendered":"

$44 Evilmouse Autonomously Executes Commands and Compromises Systems Once Connected
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A $44 hardware implant disguised as an ordinary computer mouse. This device acts as a covert keystroke injector, akin to the Hak5 Rubber Ducky, but leverages the innocuous form factor of a mouse to bypass basic user awareness training.<\/p>\n

Plug it in, and it autonomously runs payloads that execute commands, deliver reverse shells, or worse, without arousing suspicion.<\/p>\n

Traditional USB drives trigger alarms post-training, but a functional mouse? It blends seamlessly into any workspace. Evilmouse preserves the host mouse\u2019s optical sensor and buttons<\/a> via an integrated USB hub, ensuring cursor movement and clicks work normally.<\/p>\n

\n
\"Evilmouse\"
Evilmouse<\/figcaption><\/figure>\n<\/div>\n

\u201cEveryone knows USB sticks are risky,\u201d NEWO-J notes in the project write-up. \u201cA mouse might not even register as a threat.\u201d<\/p>\n

The build repurposes cheap components for under $50:<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Material<\/th>\nQuantity<\/th>\nApprox. Price<\/th>\n<\/tr>\n<\/thead>\n
RP2040 Zero microcontroller<\/td>\n1<\/td>\n$3<\/td>\n<\/tr>\n
Adafruit 2-Port USB Hub Breakout<\/td>\n1<\/td>\n$5<\/td>\n<\/tr>\n
Amazon Basics Mouse<\/td>\n1<\/td>\n$6<\/td>\n<\/tr>\n
USB-C Pigtail Cable<\/td>\n1<\/td>\n$3<\/td>\n<\/tr>\n
Rosin-core 60\/40 Solder<\/td>\n1<\/td>\n$8<\/td>\n<\/tr>\n
USB-C Data Cable<\/td>\n1<\/td>\n$8<\/td>\n<\/tr>\n
Flux Paste<\/td>\n1<\/td>\n$6<\/td>\n<\/tr>\n
Kapton Tape<\/td>\n1<\/td>\n$5<\/td>\n<\/tr>\n
Dupont Wires<\/td>\n4<\/td>\n~$0.03<\/td>\n<\/tr>\n
Total<\/strong><\/td>\n<\/td>\n~$44<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

This undercuts a Rubber Ducky\u2019s $100 price tag, democratizing hardware implants for red teams or malicious actors.<\/p>\n

Housed in a $6 Amazon Basics mouse, the compact shell demanded modifications. Researchers must excise plastic ribbing with a multi-tool cutter and delicately desolder the stock PCB\u2019s white connector using a flathead screwdriver.<\/p>\n

The RP2040 Zero, flashed with CircuitPython firmware, handles exploitation. Incompatibility with pico-ducky prompted custom code: a Windows AV-safe reverse shell to a listener host.<\/p>\n

Soldering the USB hub, pigtail, and wires proved tricky\u2014NEWO-J practiced for a week on through-hole components. Kapton tape insulates against shorts, and precise wire routing allows the shell to snap shut while maintaining functionality.<\/p>\n

Full code resides on GitHub<\/a>, with plans for DuckyScript compatibility. \u201cBuilt for education only,\u201d the repo warns, disclaiming malicious use.<\/p>\n

In a video demo, plugging Evilmouse into \u201cLaptop A\u201d yields an admin-level reverse shell on \u201cLaptop B\u201d within seconds. No user interaction required. Enhancements like hidden command prompts or scheduled tasks add persistence. Stealth tactics evade Windows Defender, though advanced bypasses remain future work.<\/p>\n

Defenses include USB device whitelisting via Group Policy, endpoint detection tools scanning<\/a> for anomalous keystrokes, and physical port restrictions. For pentesters, it offers a cheap alternative to commercial gear improve it with Rust for faster injection or remote triggers.<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post $44 Evilmouse Autonomously Executes Commands and Compromises Systems Once Connected<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Guru Baran
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

$44 Evilmouse Autonomously Executes Commands and Compromises Systems Once Connected A $44 hardware implant disguised as an ordinary computer mouse. This device acts as a covert keystroke injector, akin to the Hak5 Rubber Ducky, but leverages the innocuous form factor of a mouse to bypass basic user awareness training. Plug it in, and it autonomously […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63],"tags":[130],"class_list":["post-10601","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10601"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=10601"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10601\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=10601"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=10601"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=10601"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}