Plug and Pwn attack uses fake USB devices for Windows SYSTEM access

The Plug and Pwn attack abuses the Windows Plug and Play feature by using fake USB devices to trick Windows into installing vulnerable or insecure vendor software. This attack can lead to an attacker gaining SYSTEM-level privileges on the affected Windows system. The attack leverages the automatic installation process of device drivers triggered by USB device connection. No specific affected Windows versions or patches are detailed in the available information. There is no indication of known exploits in the wild at this time.

• bleepingcomputer.com/news/security/plug-and-pwn-attack-uses-fake-usb-devices-for-windows-system-access/ (opens in a new tab)

• Microsoft Fixes Nearly 1,100 Security VulnerabilitiesExploitedVulnerability2026-11-10
• CVE-2026-124194: Microsoft Office · Microsoft’s November 2026 Patch Tuesday addresses 1093 CVEsExploitedVulnerability2026-11-10
• Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the GlobeMalware2026-11-10
• How to navigate the SIEM correlation rule set | Kaspersky official blogAnalysis2026-11-05
• Bring a tent, I've got the coffee: Lessons from it-saMalware2026-11-05