$44 Evilmouse Malware Grants Attackers Full Control of Systems Upon Connection
A new hardware-based threat has emerged, disguising malicious code execution capabilities within an ordinary computer mouse.
A new hardware-based threat has emerged, disguising malicious code execution capabilities within an ordinary computer mouse.
Named "EvilMouse," this covert keystroke injector demonstrates how everyday peripherals can become potent attack tools with a construction cost of approximately $44.
EvilMouse functions similarly to the USB Rubber Ducky penetration testing tool but retains full mouse functionality while concealing its malicious attributes.
The device is assembled using several cost-effective components, including an RP-2040 Zero microcontroller ($3), a USB hub breakout board ($5), and a standard Amazon Basics mouse ($6).
The creator developed custom firmware in CircuitPython, which delivers a reverse shell to a specified attacker-controlled host, bypassing Windows antivirus software.
A new hardware-based threat has emerged, disguising malicious code execution capabilities within an ordinary computer mouse.
Overcoming spatial constraints within the mouse shell involved removing plastic ribbing, soldering connections to the USB breakout board, and employing Kapton tape for insulation.
In operational testing, the device granted administrator-level system access within seconds of connection, establishing a reverse shell connection to an attacker’s machine and allowing complete control over the compromised system.
This proof-of-concept highlights vulnerabilities in hardware trust assumptions, as traditional security training often neglects seemingly legitimate peripherals.
To mitigate such threats, organizations should enforce strict hardware policies treating all peripheral devices as potential risks. Measures may include using USB port locks, implementing endpoint detection systems to monitor unusual HID behavior, and requiring administrative approval for new device connections.
Regular security awareness training should extend beyond USB drives to encompass all external hardware. This $44 attack underscores that significant system compromise can be achieved with creativity and basic electronics knowledge.
Based on reporting by GBHackers.