Infected USB

by way of setoolkit

P Preparation

Before you start, prepare these tools:

Open your O.S (Operating System - Parrot OS recommended)
Fire up your VPN or Anonsurf for anonymity
Spin up your VPS (Virtual Private Server for hosting)

IMPORTANT:

You MUST have setoolkit installed for this method to work.

Official Repo: github.com/trustedsec/social-engineer-toolkit

Installation Methods:

Method 1: Via APT (Recommended)

sudo apt update && sudo apt install setoolkit

Method 2: Via Git (Latest Version)

git clone
                  https://github.com/trustedsec/social-engineer-toolkit/
                  setoolkit/

Open setoolkit and choose option 1

This opens the Social Engineering Toolkit main menu.

Choose option 3 - Infectious Media Generator

This creates a malicious file that spreads when run from USB drives.

Select File-format Exploits

This embeds the payload into a legitimate-looking file format.

Enter your VPS IP Address

This is where the connection will be sent back to.

Why not use a local IP?

Because a remote computer wouldn't be able to see your local device! The VPS acts as a bridge between the victim and you.

Choose a Payload Format (option 13)

Pick one of these exploit methods:

Adobe PDF - Embedded EXE Social Engineering

Microsoft Word RTF - PF_Feat_ind Exploit

Microsoft Word RTF - Object Confusion

Select Windows Meterpreter Reverse HTTPS SSL

This creates an encrypted connection that's harder to detect.

Set LHOST to your IP

This tells the payload where to connect back to.

Set LPORT to 443

Port 443 is used for HTTPS traffic - less likely to be blocked.

Plug in your USB and press YES

This starts the listener - setoolkit will now wait for connections.

Create the Malicious USB

Open a second terminal, find the malicious file, copy it to your USB, and rename it to something innocent (e.g., "Invoice_Final.rtf", "Resume_2026.doc", etc.)

Tip: Choose a file name that looks legitimate to increase chances of the victim opening it.

Quick Summary

LHOST: Your VPS IP Address

LPORT: 443

Payload: Meterpreter Reverse HTTPS

File Format: PDF or Word (.rtf)

DISCLAIMER

This information is for educational purposes only. Unauthorized access to computer systems is illegal.