ChoiceJacking at Public Charging Ports: A New Twist on Mobile Data Theft

Oct 13

4 min read

Cybersecurity researchers have shown that a malicious USB charger can sometimes bypass the prompts designed to keep a phone’s data connection under the user’s control. The finding is serious, but it is a laboratory result—not proof of widespread attacks at airports or cafés.

Illustration: a public charging point can carry both power and data.

What researchers discovered

For years, phones have asked people to approve a USB data connection when a newly connected host requests access. That safeguard was meant to prevent a charging port from quietly reading files. A 2025 paper from researchers at Graz University of Technology and Austria’s A-SIT described a way around that assumption: a malicious charger can impersonate input devices and send actions that make the phone approve its own data-transfer prompt. The researchers named the technique ChoiceJacking. 1

The team evaluated a custom-built charger against 11 mobile devices from eight manufacturers, including Android phones and an iPhone. Their test devices were running Android 12, 13 or 14, or iOS 17. At least one of the researchers’ attack variants worked on every tested device. Depending on the model and the device’s state, the charger could obtain access to photos, documents or app data through USB protocols. In some cases, it could obtain development-level access; the paper also reports file access on locked devices from two manufacturers. These are results from controlled laboratory tests, not a claim that every model or current software release remains vulnerable. 1

The underlying weakness was not simply that a phone was plugged into a USB socket. The researchers found that a charger could exploit the way some USB and mobile operating-system implementations handle input and connection roles. That let it imitate a keyboard or other input source and confirm a prompt without the owner’s deliberate approval. A brief screen change may occur, but the researchers also explored how to time an attack when a user is less likely to notice it. 1 2

Illustration: USB can carry energy and data over the same connection. Whether a phone exposes anything depends on its operating system, settings and the behavior of the connected hardware.

Why the finding deserves attention—and perspective

ChoiceJacking revives a familiar concern, often called “juice jacking,” but adds a different technique. Earlier examples relied on a user accepting a data-access request or on older device protections. The new research shows that a charger may be able to simulate the approval itself. That is a meaningful security finding because a prompt is only useful when the system can reliably distinguish the person’s decision from input generated by the connected device. 1 3

The researchers reported their findings to affected vendors before publication. Their paper records acknowledgements and remediation work across vendors, and later reporting describes stronger authentication requirements in newer Apple and Android releases. Protection can still vary by handset maker and software version, particularly where Android vendors customize the USB stack. Users should install current operating-system and security updates rather than assume that a version number alone guarantees protection. 1 2

At the same time, a successful lab demonstration does not establish that public charging stations are commonly being used to steal data. Reporting on the broader juice-jacking concern has noted a lack of publicly verified real-world victim cases. The 2025 study establishes technical feasibility on selected devices under test conditions; it does not measure how often criminals deploy such equipment in public. 2 3

Practical ways to reduce exposure

The simplest option is to charge from a regular AC outlet using your own power adapter and cable, or to use a trusted power bank. A dedicated USB charge-only cable or a reputable data-blocking adapter can also prevent data lines from connecting, though some accessories may reduce fast-charging performance. When travelling, avoid unfamiliar cables and accessories left plugged into public kiosks.

Keep the phone’s software current. If a USB connection unexpectedly asks to trust a computer, choose a data-transfer mode, or unlock the device, disconnect unless you intentionally connected it to a trusted computer. Do not approve prompts simply to make a public charger work. These habits reduce avoidable exposure, but they are not a reason to panic about every charging point. 2 4

Closing Thoughts

ChoiceJacking is a reminder that a charger is not always just a source of electricity. A USB connection can also establish a data channel, and protections based on a confirmation prompt can fail if connected hardware can simulate user input. The research gives device makers a concrete reason to strengthen USB authentication and gives users a clear reason to keep software updated.

What is the true implication of this?

The central implication is a design lesson: sensitive access should not depend on a prompt that the device itself can accept through untrusted input. Mobile platforms need robust separation between charging and data access, and user approval should be authenticated in a way a connected accessory cannot imitate. The work also shows why independent testing remains valuable even after a security feature has been deployed for years.

How does this impact us?

For most people, the risk is best managed with ordinary precautions, not alarm. Use your own adapter or battery pack when convenient, keep your phone patched, and treat unexpected data-access requests as a warning. For device manufacturers and public-charging operators, the research underscores the need for safer defaults, well-maintained equipment and clear user guidance. The study demonstrates a real technical weakness in tested devices; it does not show that everyday public charging is already a widespread source of compromise.

Videos for reference