See the recent BadUSB attack [1][2] for how this sort of attack can work; the firmware of the USB microcontroller itself can be infected.

[1] https://srlabs.de/badusb/ [2] http://www.wired.com/2014/07/usb-security/