How a USB-connected speaker can infect a PC without ever being touched

A researcher demonstrated a remote, over-the-air firmware replacement attack against a Katana V2X Bluetooth speaker running FreeRTOS. By adding a secondary USB HID descriptor that reports the device as a keyboard and reusing firmware code to send keypresses, the attacker can inject keystrokes into connected PCs (e.g., open PowerShell and execute commands). The proof-of-concept shows potential for persistent, hard-to-remove malicious firmware and highlights that Bluetooth remains enabled even in sleep, increasing attackability.