USB Rubber Ducky and DuckyScript 3.0: How Cross-Platform Keystroke Injection Attacks Work in 2026
With DuckyScript 3.0, USB Rubber Ducky attacks have taken a major leap forward. This new language allows malicious code to adapt dynamically, targeting Windows and Mac with precision while enhancing flexibility for hackers.
On this page 11 sections
In 2026, USB Rubber Duckies continue to evolve rapidly and cybersecurity threats from physical keystroke injection devices are expanding. DuckyScript 3.0, released alongside the latest generation of the Hak5 USB Rubber Ducky, has transformed the device from a single-platform script executor into a full cross-platform attack tool capable of intelligently adapting to Windows, macOS, and Linux environments. Physical access attacks using USB devices have increased in frequency as organizations focus their security investment on network and endpoint defenses while underestimating physical security risks. Penetration testers and red teams report that USB drop tests continue to achieve high success rates even in organizations with mature security awareness programs.
What Is a USB Rubber Ducky?
The USB Rubber Duckyis a malicious device disguised as a USB drive but actually acts as a keyboard emulator. Once plugged into a target computer, it can execute a series of predefined commands or scripts designed to perform a variety of malicious actions. Originally, the device had a significant limitation. It required carefully designed, OS specific attack commands, limiting its success rate. But with the release ofDuckyScript 3.0, this has changed dramatically.
Why DuckyScript 3.0 Matters
DuckyScript 3.0 represents a substantial upgrade from previous versions, turning the Rubber Ducky into a powerful programming tool for cyber attacks rather than a simple keyboard script executor. While DuckyScript 2.0 could execute sequential commands, the updated DuckyScript 3.0 allows for:
- Advanced flow control (with conditional checks and loops)
- Function definitions that let code run modularly
- Variable storage and use
- Device and OS based logic
These features enable hackers to target both Windows and macOS devices with conditional commands. A Rubber Ducky can now “think” before executing, deciding which attack script to run based on the detected operating system, checking for specific software versions, or even self terminating if connected to the wrong machine.
Real World Capabilities of the Updated Rubber Ducky
Let's look at how these features might play out in realistic attacks:
1. Credential Theft
With DuckyScript 3.0, a Rubber Ducky can check if it’s connected to a Windows machine. If confirmed, it can execute a credential harvesting script tailored for Windows. Alternatively, if it detects macOS, it can run a macOS specific script for password theft. This adaptability significantly increases the threat to cross platform environments.
2. Network and Browser Manipulation
Older Rubber Ducky scripts could, for example, make Chrome send saved passwords to an attacker’s server. Now, with conditional logic and variables, it could selectively target browsers and send phishing emails or network requests based on the detected OS or software environment.
3. Data Exfiltration and Remote Control
More advanced DuckyScript functionality allows hackers to establish backdoors or remote control options on targeted systems. A script might exfiltrate files, monitor network traffic, or redirect the victim’s DNS to an attacker’s server.
These capabilities turn the USB Rubber Ducky into more than a one time-use device. It’s now programmable, versatile, and ready to adapt on the fly, increasing the complexity of cybersecurity defenses required.
Understanding DuckyScript 3.0 and Its Features
Let’s look more closely at the updates in DuckyScript 3.0 that enable these advanced functions.
Enhanced Logic and Flow Control
DuckyScript 3.0 introduces if-else statements, loops, and other control flow features that let the script make decisions based on variables, user input, or machine conditions. For example:
IF OS Windows
RUN Windows-specific-commands
ELSE
RUN Mac-specific-commands
END
This allows for flexible scripting that can be deployed on any system, making it highly adaptable and resilient to a range of targets.
Keepnet platform
Turn awareness into secure behaviour
Training, multi-channel phishing simulations and reporting in one platform, measured by behaviour.
Functions and Variable Storage
With the ability to store variables and use functions, DuckyScript 3.0 resembles a basic programming language rather than a simple script executor. A Rubber Ducky can perform tasks based on stored data, giving it the ability to remember previous steps and avoid redundant commands. For instance, the script could check for a Wi-Fi network connection, store that information, and proceed with data exfiltration only if a network connection is verified.
Conditional Commands Based on System Environment
The new scripting language includes the ability to detect the target operating system and software version before deploying malicious actions. This conditional behavior allows for device specific attacks, minimizing detection risks and reducing reliance on hardcoded, single platform scripts.
The Future of USB Based Attacks with Rubber Ducky
As USB Rubber Ducky devices evolve, security professionals must stay vigilant, especially since physical access attacks are increasingly being combined with social engineering. In 2026, attackers have been documented staging USB drop attacks in conjunction with voice phishing (vishing) calls to IT helpdesks, where an attacker calls posing as a vendor while an accomplice plants a device. Multi-vector physical attacks of this type require organizations to train employees on physical security as rigorously as they train them on email phishing. USB devices found anywhere on premises should be treated as potential threats and handed to IT security without being connected.
Key Security Strategies to Combat USB Rubber Ducky Attacks
Understanding how attackers exploit USB devices is critical to defending against them. Here are some best practices for mitigating Rubber Ducky attacks:
1. Employee Awareness and Training
Security awareness training on the dangers of USB devices is essential. Employees must understand that plugging in unknown devices could potentially expose them to malicious scripts capable of credential theft or data exfiltration. Training programs, such as Keepnet’s Security Awareness Training, can significantly reduce the success rate of these attacks.
2. Limit USB Port Access
Restrict USB port usage to only approved devices, which helps reduce the risk of USB based attacks. Policies that enforce USB access control or disable unused ports are simple yet effective strategies.
3. Use Phishing and USB Simulators
USB based attack simulators allow security teams to test their employees’ awareness and response to USB based threats. The Phishing Simulator is also a valuable tool for assessing how employees respond to realistic attack simulations, including USB based exploits.
4. Implement Endpoint Detection and Response (EDR) Tools
Modern EDR tools can detect unusual USB device behavior, helping identify and stop attacks before they gain access to sensitive information. By monitoring for suspicious activity, these tools add an extra layer of defense against USB borne threats.
Final Thoughts
With DuckyScript 3.0, USB Rubber Ducky attacks are more flexible, adaptable, and dangerous than ever. In 2026, the threat has expanded beyond the classic Rubber Ducky to include O.MG cables that look like standard charging cables but contain full keystroke injection capability, and purpose-built devices marketed explicitly to red teams and attackers at increasingly accessible price points. The barrier to conducting a sophisticated physical access attack has never been lower. Organizations that rely solely on network security controls while neglecting physical security policies, USB restriction enforcement, and employee training on device handling are significantly exposed.
Frequently asked questions
A USB Rubber Ducky is a penetration testing tool that looks like a standard USB flash drive but is actually a programmable keystroke injection device. When plugged into a computer, the target system recognizes it as a keyboard rather than a storage device, allowing it to automatically type pre programmed commands at speeds far faster than a human typist. Because computers trust keyboards by default, the Rubber Ducky can execute scripts that open terminals, download malware, exfiltrate data, or modify system settings within seconds of being connected. In the hands of an attacker, it can compromise a device before the user realizes anything has happened.
DuckyScript 3.0 is the third generation of the scripting language used to program USB Rubber Ducky payloads. It adds conditional logic including if-else statements and loops, function definitions that allow reusable code blocks, variable storage, and the ability to detect the target operating system and adapt commands accordingly. This means a single Rubber Ducky payload can now intelligently branch between Windows, macOS, and Linux specific commands, making it cross platform capable. Previous versions required separate payloads for each operating system.
Attackers use several physical delivery methods. The most common is leaving malicious USB devices in locations where curious employees are likely to pick them up and plug them in: car parks, reception areas, conference rooms, or near target organization entrances. USB devices may be branded with company logos or labeled as IT assets to increase the likelihood of being connected. Attackers may also directly connect a Rubber Ducky when they have physical access to a workstation, for example during a cleaning service visit, a social engineering pretext visit, or an insider threat scenario.
USB Rubber Ducky attacks can complete their payloads in seconds. Because the device types at machine speed rather than human speed, complex scripts that would take a person several minutes to type can execute in under ten seconds. A credential theft payload that opens a terminal, runs a password dumper, and exfiltrates results over the network can complete before a user sitting in front of the screen realizes anything is happening. This speed is one of the reasons physical access control and USB port restrictions are critical security controls.
Traditional antivirus software looks for malicious files written to disk or known malware signatures in running processes. A USB Rubber Ducky attack works by simulating keyboard input, which is a normal and trusted system operation. The commands it types may use legitimate built in system tools such as PowerShell, Bash, or the Windows Command Prompt. Because no malicious file is transferred from the device and the commands use trusted system utilities, many endpoint protection tools will not alert on the activity. Behavioral detection tools that monitor for unusual command sequences are more effective but can still miss well crafted payloads.
A USB Rubber Ducky is a keystroke injection device designed to execute software attacks by simulating keyboard input. It does not physically damage hardware. A USB Killer is a destructive device that stores charge from the USB power pins and then discharges a high voltage surge back into the host device, destroying its circuits. The two devices serve completely different attack purposes: the Rubber Ducky is a data theft and system compromise tool, while the USB Killer is a physical destruction tool. Both underline why organizations should have clear policies about unknown USB devices.
Organizations can implement endpoint management policies that allow only pre approved USB devices identified by their hardware ID or cryptographic certificate. This allows legitimate storage devices and approved peripherals to function normally while blocking unknown devices including Rubber Duckies. USB device control policies can be enforced through endpoint management platforms and can be configured to log all USB connection events for security monitoring. For high security environments, physical USB port blocking with locks provides a hardware level control that policy alone cannot achieve.
Depending on the payload programmed into the device and the access level of the logged in user, a Rubber Ducky can exfiltrate saved browser passwords, Windows credential hashes from the SAM database, SSH keys and other authentication credentials, recent documents and files, Wi-Fi network passwords, VPN configuration data, and any other data accessible to the user account. With DuckyScript 3.0, attackers can write payloads that intelligently search for high value files before exfiltrating them, rather than simply dumping all accessible data.
Employees should be trained never to connect an unknown USB device to a work computer or personal device under any circumstances. If a USB device is found on company premises, the correct action is to hand it to the IT or security team without connecting it, so it can be safely analyzed. This behavior needs to be practiced and reinforced through security awareness training because human curiosity is a reliable attack vector: employees who have not been specifically trained on this risk frequently plug in found USB devices. Keepnet's Security Awareness Training includes physical security modules that cover USB drop attacks and appropriate response procedures.
USB Rubber Ducky attacks demonstrate that cybersecurity is not purely a digital discipline. Physical access to a device, even for seconds, can result in a complete compromise. This has implications for office security policies, visitor management, clean desk policies, and the management of shared or public workstations. Security awareness training that covers physical security scenarios alongside phishing and social engineering provides employees with a comprehensive understanding of the attack surface they need to protect. Keepnet's human risk management strategies address both the digital and physical dimensions of organizational security.
Schedule your 30-minute demo now
You'll learn how to:
- Identify and counteract sophisticated USB Rubber Ducky attacks across Windows and macOS platforms.
- Deploy training simulations to improve employee response to USB-based threats.
- Integrate adaptive detection tools to monitor and mitigate suspicious USB activity effectively.
30 minutes with a Keepnet specialist, on your own use cases.
Author
Ozan Ucar
Founder and CEO, Keepnet
Ozan founded Keepnet in 2017 and has worked in cyber security since 2006. He leads Keepnet's product direction and works with security teams on measuring and changing the behaviours behind incidents.