Plug-and-Play Trick Turns a Fake USB Stick Into Full Windows 11 Takeover

Key points

• Researchers found that Windows Plug and Play, the feature that auto-installs software when you connect a device, can be tricked into running vendor installers with the highest level of access on a fully patched Windows 11 machine.
• The attack works with a fake or emulated USB device, so no genuine hardware is required.
• It also fires over Remote Desktop sessions when USB redirection is switched on, meaning an attacker does not need to be in the room.
• Microsoft has been notified and the researchers chained signed, legitimate installer components to reach SYSTEM, the account with total control of the computer.
• Defenders should audit which vendor installers auto-run on device insertion and restrict USB redirection on remote sessions.

A new attack technique turns one of Windows' most everyday conveniences into a route to complete control of a machine. When you plug in a printer, headset or USB stick, Windows looks up the device, fetches the vendor's driver software and installs it for you. That handy feature is called Plug and Play (PnP).

Researchers have shown that an attacker can pretend to be a device Windows trusts, get the operating system to download the real vendor's signed installer, and then abuse steps inside that installer to gain SYSTEM privileges. SYSTEM is the account with more power than any human user on the machine. If you own SYSTEM, you own the box.

The demonstration ran on a fully updated Windows 11 machine, first reported by The Hacker News. That is the uncomfortable part: the underlying components are legitimate, digitally signed vendor code doing what it was designed to do.

How does the attack actually work?

An attacker plugs in a USB device, or emulates one in software, that identifies itself as hardware from a specific vendor. Windows Plug and Play recognises the identifier, pulls down the matching driver package and hands control to the vendor's installer, which runs with high privileges so it can drop files into protected folders and register services.

The researchers found that some of these installers do things that can be redirected: writing to locations a normal user can influence, loading helper files from predictable paths, or calling secondary components without checking them properly. Chain those weaknesses together and the installer, running as SYSTEM, ends up executing code the attacker controls.

Crucially, no exploit of a Windows zero-day (an unknown flaw in Microsoft's own code) is required. The bugs live in third-party installer logic that Windows happily launches on your behalf.

Do the attackers need physical access?

No, and that is what makes this uglier than the usual "rogue USB stick" story. The same Plug and Play path can be triggered across a Remote Desktop session when USB redirection or low-level PnP redirection is enabled. Remote Desktop is the Windows feature that lets you use a computer over the network as if you were sitting at it.

With redirection on, a device "plugged in" at the attacker's end appears to the remote server as if it were plugged into the server itself. Windows on the far side dutifully fetches the vendor driver and runs the installer. Any user with remote session rights, including a low-privileged one, could ride this path up to SYSTEM.

What should defenders do now?

Treat vendor installers as an attack surface, not background noise. The technique does not need malware in the traditional sense: the attacker rents a lift already installed in the building.

Microsoft has been informed. Until guidance lands, the shortest path to reducing risk is turning off USB redirection on Remote Desktop hosts and reviewing which device classes your endpoints will silently install software for.

Ordinary users do not need to do anything special. This is an enterprise configuration problem, not a "don't click the link" problem.