“TRUST STARTS & ENDS WITH THE TRUTH”
“TRUST STARTS & ENDS WITH THE TRUTH”
Matt is both the company founder and a nationally renowned private investigator. Matt is an intelligence specialist who excels in detecting and preventing the illegal interception of communications and in providing high-tech covert surveillance. Matt has years of hands on experience in the investigation industry and has developed a reputation for incorporating state of the art technology and innovative ideas to provide effective solutions for his clients. Matt also serves as Treasurer for the Executive Board of Directors of FALI, The Florida Association of Licensed Investigators.
An O.MG Cable is a USB cable with a hidden Wi-Fi implant that lets another person type commands into the device it is plugged into. I lead the counter-surveillance practice at Southern Recon Agency, and a charging cable is the object clients rarely think to question. Below is how to recognize the risk and what to do with a cable you do not trust.
An O.MG Cable makes a computer or phone believe a keyboard has been plugged in, then lets someone else do the typing over Wi-Fi. Hak5, the security hardware company that sells the product, describes it as a handmade USB cable with an implant hidden inside.
The clearest way to picture the implant is a second keyboard hidden in the cable, with another person’s hands on it. Anything you could type, that person can type. Programs open, settings change, and files get sent somewhere else. The Elite model types at up to 890 keys per second, so several hundred characters of commands land in about one second.
The Elite model also carries a hardware keylogger that stores up to 650,000 keystrokes from a keyboard connected through the cable. Passwords captured by a keylogger are recorded as they are entered, which is the same kind of gap I describe in my guide to what phone encryption does not stop.
Hak5 sells the O.MG Cable to security teams for authorized testing, and the company ships each one deactivated. The concern for everyone else is the same tool in the hands of someone with a personal motive.
The O.MG Cable was created by a security researcher known as MG and is sold through Hak5. Vice reported in 2019 that MG showed handmade prototypes at the Def Con hacking conference, built from modified Apple Lightning cables. Hak5 now sells production versions as a testing tool for security teams.
Hak5 listed the O.MG Cable at $150 when this article was written, and the product comes in Basic and Elite tiers. The price matters for anyone weighing personal risk. A covert implant at $150 is within reach of a business rival, a former partner, or a curious coworker.
An O.MG Cable and a normal USB cable look and behave the same until the implant is switched on, and the differences sit inside the connector.
| What people assume | What is true |
|---|---|
| A charging cable only carries power | Standard USB cables carry data as well as power, and an O.MG Cable adds a hidden implant that can send keystrokes |
| A tampered cable looks or works differently | Hak5 says the dormant cable behaves like a normal USB 2.0 cable, with 5 V charging and 480 Mbps data transfer |
| The attacker has to be in the room | The implant is controlled over Wi-Fi from a web browser, and the Elite model can be reached over a network connection |
| Security software will flag the cable | The implant presents itself as a keyboard, and Hak5 markets the cable as leaving no logs while dormant |
None of the four assumptions gives you a way to clear a cable by handling it.
People with a specific adversary are the ones at risk from a malicious USB cable, because someone has to buy the cable, prepare it, and get it into your hands. Strangers at random rarely justify that effort.
The situations my team takes seriously share one feature, which is another person with a motive and access to your belongings:
Consider a spare charging cable that turns up on a kitchen counter during a separation, when neither person remembers buying it. The useful question is who had access to that counter.
For companies, a corporate communication security audit reviews phones, networks, and meeting rooms, and unvetted accessories belong in the same conversation. A suspicious cable that arrives alongside other unwanted contact is a matter for our stalking and harassment investigations team.
Juice jacking and the O.MG Cable are different threats. Juice jacking means malware loaded through public USB charging stations. The FCC says the tactic has been demonstrated as a proof of concept and knows of no confirmed instances. An O.MG Cable is a product on sale today, handed over by a specific person.
Unplug a cable you do not trust, stop using it, and keep it somewhere safe as possible evidence.
Red flags:
Next steps, in order:
Leave the connector intact. Cutting a cable open destroys the evidence an examiner or an attorney may need later.
If the cable was plugged into a phone you own, a mobile forensics examination checks the device for signs of unauthorized access and physical tampering, then documents the findings.
A malicious cable is found through a physical search combined with analysis of the wireless signals in the space. Our technical surveillance countermeasures sweeps pair a hands-on inspection with equipment such as rogue Wi-Fi detectors and frequency spectrum analyzers, which look for transmitters that have no reason to be in a room.
An implant controlled over Wi-Fi is a transmitter while active. A dormant implant may stay silent, which is why the physical search carries as much weight as the electronics.
The method follows the same order I describe in my explanation of how hidden listening devices are found: assess who has access to the space, search by hand, then examine signals and power.
Consumer tools exist as well. Hak5 sells a Malicious Cable Detector, a small device made for checking cables.
Not reliably. Hak5 describes the cable’s outer end as camouflage chosen to blend in with the target’s surroundings, and some versions carry no markings. Weight, color, and brand printing are poor guides. The source of the cable is the better test, and a cable bought sealed from a known retailer passes it.
A phone or laptop that met an unfamiliar cable can be examined, and the findings documented for you or your attorney.
Ask an investigator about your device
Confidential, and handled by a licensed Florida investigator.
Hak5 sells the O.MG Cable openly for authorized security testing, and using one on someone else’s device without permission is a crime in Florida.
Florida law makes it an offense to willfully and knowingly access a computer or electronic device without authorization. Hak5’s own terms limit the product to authorized auditing and security analysis, and the buyer is responsible for following local law.
If a dispute may reach a courtroom, digital forensics preserves what the affected device recorded in a form an attorney can use. Early preservation matters, since evidence on a device in daily use changes over time.
The information in this section is general, applies to Florida readers, and is not legal advice. Laws differ in other states.
An O.MG Cable is a working USB cable with a hidden Wi-Fi implant that types commands into whatever it is plugged into. Hak5 sells the cable for authorized security testing, and the Elite model stores up to 650,000 keystrokes. Looking at a cable will not clear it, so judge the cable by where it came from. If a cable worries you, unplug it, keep it intact, change passwords from another device, and have the affected device examined.
Find out whether the cable or the device is the problem, with the findings written up for you.
Request a confidential consultation
Florida licensed agency A1400197. Call 844-307-7771.
Hak5 states that O.MG Cables with a USB-C active end can send payloads to mobile devices that have a USB-C connector. The product page makes no model-by-model claim, so the careful reading is that a phone with a USB-C port falls within the cable’s stated reach. Use only cables you bought yourself.
Antivirus is a weak defense against an O.MG Cable. The implant introduces itself as a keyboard, and Hak5 markets the cable as dormant, with no logs, until a command is sent. Antivirus software scans files and programs, so a device that only types gives it little to inspect. Control over your own cables is the stronger protection.
A charging-only cable helps at public charging ports. The FCC suggests carrying one from a trusted supplier, because a charging-only cable prevents data from being sent or received while a device charges. The protection depends on the cable being the one you bought, so keep it with you when you travel.
Set the cable aside and use a replacement from a known retailer. A compromised cable can expose every password typed on the device it connects to, and a new cable removes the question. Keep the suspect cable unplugged and stored in case you later want it examined.
Yes, for devices you own. Southern Recon Agency’s mobile forensics work looks for spyware, unauthorized access, and physical tampering on a client’s own phone, then documents the findings. We do not access anyone else’s devices. A consultation is the place to ask what can be examined in your situation.
Matt Aubin is the founder and managing partner of Southern Recon Agency, which he started in 2010. He leads the firm’s counter-surveillance practice, built its digital forensics program, and is a court-qualified expert witness in cyber intelligence and cyber forensics. Matt is a Certified TSCM Technician, a Certified Digital Forensics Examiner, and a Florida Board Certified Investigator, and he is a member of the U.S. Secret Service Miami Electronic Crimes Task Force and FBI InfraGard Tampa.
Everything in this article is general information and is not legal advice. For help with a specific situation, talk to a licensed attorney in your state.