O.MG Cable Hak5

O.MG Cable Elite is a programmable security testing and red team training tool concealed in an ordinary-looking USB cable. The implant inside its connector emulates a keyboard and mouse. Prepared scenarios can be triggered over Wi-Fi from a browser-based control panel.

SAPSAN ships cables already activated and updated. You do not need a separate programmer to get started. Creating your own payloads, or test scripts, requires DuckyScript; their behaviour depends on the target operating system, keyboard layout and device configuration.

Discretion and stealth mode

Also known as the “NSA cable”, O.MG Cable conceals its implant inside the connector. Hak5 describes the implant as dormant until a payload is triggered, while the cable retains normal USB 2.0 data transfer and charging functions. BadUSB attacks use input-device emulation. This stealth description applies to the dormant implant; detection of actions performed by a running script depends on the environment’s security controls.

What Elite offers

• Keyboard and mouse injection: automated input, DuckyScript payloads and a browser-based editor.
• Wi-Fi control: trigger scenarios and configure the cable from a browser on a computer or phone.
• Hardware keylogger: capture keystrokes from a compatible USB Full Speed keyboard with a detachable cable. Connect the keyboard to the passthrough end and the active end to the host. Check the documentation for compatibility with your keyboard.
• HIDX Stealth Link and Networked C2: additional communication channels for testing, including encrypted network control, requiring appropriate configuration.
• Geofencing and Wi-Fi triggers: actions based on the surrounding wireless environment.
• Self-destruct: erase stored payloads and captured data and deactivate the implant; restoring it requires a programmer.

Feature availability, syntax and payload limits depend on the firmware. Hak5’s latest comparison table describes beta firmware specifications; consult the documentation for the version you use.

Active connector and passthrough end

Payloads are delivered through the active connector. Connect this end to the device being tested. The selected variant specifies an active USB-A, USB-C or directional C-to-C connection. The other end provides passthrough connectivity; this does not make it an active testing connector. For Directional C-to-C, check the active-end marking and the manufacturer’s connection instructions.

Getting started and updating

Connect the active end to a suitable USB port, join the cable’s Wi-Fi network and open its web interface. The manufacturer’s defaults are network O.MG, password 12345678 and address 192.168.4.1. Create and edit payloads in this interface.

The O.MG programmer is used for activation, firmware updates and recovery, including recovery after self-destruct. It is not required for routine script editing in the web interface. One programmer supports O.MG cables, adapters and plugs.

Power and connectivity

• Wi-Fi: 802.11b/g/n, 2.4 GHz.
• Power: 5 V ±0.5 V; a USB source capable of supplying at least 500 mA.
• Passthrough data: USB 2.0, up to 480 Mbps, with the active end connected to a USB host.
• Passthrough charging: 5 V maximum. The manufacturer supports USB-PD with negotiation limited to 5 V. Higher voltages or unsupported charging protocols can damage the cable and connected equipment.

Manufacturer documentation

• O.MG Cable Quick Start
• Complete O.MG documentation
• Keyboard compatibility and keylogging
• Web Flasher - firmware updates