They could do lots of things:

- Keylogging

- Manipulate USB Power negotiation to cook your hardware

- Sniff traffic from other USB devices on the same internal hub.

- Log your location

- Log screen lock/unlock times/habits via voltage draw and permitted device type enumeration

- Install malware via keyboard emulation

- Sound exfiltration by emulating USB speakers

- Screenshot by emulating a USB/thunderbolt external monitor

- Mouse movement/click injection to prevent screen locking

- Exfiltrate data to hidden internal flash memory

"HID commands" are a big thing given sufficient automation. You can execute arbitrary code with just HID commands either by typing everything in, or by having the cable present a storage device from which to get data and using HID commands to enable the storage device, fetch and execute it.

USB has been littered with bugs. I never got why this didn't get more news coverage but at least it was possible to read memory from USB. Personally for me it's also a reason that I switched to USB-C that there are less people around with USB-C cables.

https://security.stackexchange.com/questions/118854/attacks-...

You can actually do quite a lot with it, in terms of getting data and dropping various payloads:

There is also an editor and parser for Duckyscript – the scripting language used by the Rubber Ducky offensive USB drive – which acts as a virtual keyboard and launches keystroke injection attacks. That alone opens up a wide array of custom payloads for the O.MG cable. There also appear to be attack payloads for Windows and Ubuntu systems.

In April 2019, when the video was released, MG and the team of hackers working on the embedded cable were also developing extra functions such as detecting user activity/inactivity. According to the Hak5 listing, they also appear to have cracked another key problem: USB enumeration.

https://nakedsecurity.sophos.com/2019/10/02/omg-evil-lightni...

See for example: https://en.m.wikipedia.org/wiki/DMA_attack