Evil Maid Attack.

A physical attack in which an adversary briefly accesses an unattended device to tamper with firmware, bootloader, or hardware and steal secrets later. It belongs to the Attacks & Threats category of cybersecurity.

A physical attack in which an adversary briefly accesses an unattended device to tamper with firmware, bootloader, or hardware and steal secrets later.

An Evil Maid Attack, named by Joanna Rutkowska in 2009, describes a scenario where an attacker with brief physical access to a powered-off device modifies it to capture credentials or plant a persistent implant. Classic variants tamper with the bootloader of a full-disk-encrypted laptop to log the pre-boot passphrase the next time the owner unlocks it. More advanced variants add hardware keyloggers, firmware implants, or compromised peripherals. The attack defeats software-only disk encryption because trust is rooted in unverified boot code. Defences include measured boot, TPM-bound keys, Secure Boot, tamper-evident seals, and never leaving devices unattended in hotels, conferences, or border crossings.

Defences for Evil Maid Attack typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Maid attack, Unattended device tampering.