A USB that was both storage and a keyboard, that executed the keystrokes to download malware, was demo'd at a DefCon a few years back.
Even worse than a rubber ducky: the O.MG cable does the same thing, but looks like a regular USB cable. Their Apple Lightning-dupe [0] is my favorite. The creator was on Darknet Diaries a while ago, too. [1]
[0] https://shop.hak5.org/products/omg-cable [1] https://darknetdiaries.com/episode/161/
BadUSB, Blackhat 2014.
That's almost 12 years now. A novice can now get ATmega32 USB devices Prime delivered. Not a cutting edge theoretical attack anymore but a basic tool in a every pen tester's toolbox now.
I know we're not in the era when a windows pc will happily run any autorun.inf and .EXE file found on an inserted flash drive or DVD anymore. But even so. What if it didn't even have any malicious data payload but somebody was shipping USB-A interface capacitor based usb killers?
https://www.slashgear.com/1819672/usb-killer-explained-kill-...
What if it did have data on it and came with a slick color brochure walking people through how to run the binary, or in a linux or developer specific audience, how to 'sudo' the ELF binary that lives on its filesystem?