[xevenofhearts]

To be completely honest, I've never tested this, but I think it's plausible. My idea is to load a key logger onto a USB drive, then set it to auto run the application once the USB is plugged in, and start logging. Social engineer them into using this USB, say, to give them a picture, or some report that you couldn't email because it was too large. If they're on OS X, it might ask them before they run it, but if you guide them through it, they'll probably think allowing it is harmless. Casually leave, "forgetting" your USB. They'll probably forget about it too, and keep it chillin'. Feedback please?

[1llusion]

Wait... are you talking about spreading via USB flash drive? That is quite common (Used to be via autorun.inf, now they use exploits like the LNK exploit). Or a hardware keylogger? (they exist too, you plug them between the keyboard and the computer and they monitor every key. No installation required, undetectable by antiviruses and work on any OS).

EDIT: just found the LNK exploit (http://www.exploit-db.com/exploits/16574/). I might do a little tutorial on it on my blog

[xevenofhearts]

Wait... are you talking about spreading via USB flash drive? That is quite common (Used to be via autorun.inf, now they use exploits like the LNK exploit). Or a hardware keylogger? (they exist too, you plug them between the keyboard and the computer and they monitor every key. No installation required, undetectable by antiviruses and work on any OS).

Pretty much. I think that there are hardware key loggers from KeyGhost or some company along those lines, I really just don't want to buy one because they're kind of expensive.

\\\ Edit to your edit: I will for sure check that out. Is it for OS X?

[1llusion]

Wait... are you talking about spreading via USB flash drive? That is quite common (Used to be via autorun.inf, now they use exploits like the LNK exploit). Or a hardware keylogger? (they exist too, you plug them between the keyboard and the computer and they monitor every key. No installation required, undetectable by antiviruses and work on any OS).

Pretty much. I think that there are hardware key loggers from KeyGhost or some company along those lines, I really just don't want to buy one because they're kind of expensive.

\\\ Edit to your edit: I will for sure check that out. Is it for OS X?

Not really... The LNK exploit specifically targets Windows. And has been patched since Stuxnet was found, so your chance of successful exploit isn't that high...

I've seen somewhere a project how to build your own hardware keylogger, but it was some time ago and I forgot where. Google around and I'm sure you will find it