Unknown USB drives can contain malware; only use trusted devices.
USB drives are a consistently underestimated attack vector. Physical USB attacks bypass network firewalls, antivirus signature databases, and email filters entirely. A drive that appears in a parking lot, on a conference table, or mailed as a "free gift" can compromise a device in under 60 seconds.
The most dangerous USB attacks do not need to install traditional malware. A Rubber Ducky or similar device registers as a keyboard and types commands. It can disable security software, create a backdoor account, exfiltrate files, and leave within 30 seconds — all through the trusted keyboard input channel.
Public USB charging stations at airports, hotels, and cafes present a real risk. A compromised charging port can access and copy data from your phone or install malware. Use a data-blocking USB adapter (also called a USB condom) that passes power but blocks data pins, or carry your own power bank.
For legitimate USB use: only use drives from trusted, verified sources, scan new drives with antivirus before accessing files, enable Windows' autorun prevention (it is off by default in modern Windows but verify), and encrypt drives that contain sensitive data so a lost drive does not become a breach.