Open Source · ESP32-S3 · LoRa · AES-256
Long-range keystroke injection over encrypted mesh
MIA is a USB implant that receives encrypted commands over a LoRa mesh network and injects them as keystrokes on the target machine. No physical access required after deployment.
What is the MIA?
A LoRa-based HID implant for red teamers
The Mesh Injection Apparatus is a keystroke injection implant built on the ESP32-S3. It enumerates as a USB keyboard when plugged into a target machine, then sits silently waiting for commands delivered over an encrypted LoRa mesh network.
Commands are sent from any standard Meshtastic node — a phone running the app, a stock Heltec board, anything on the same channel. The mesh handles routing. MIA handles execution. The attacker never needs to be in the same room, or even the same building.
All traffic is AES-128 or AES-256 encrypted using Meshtastic's channel PSK system. Private channels mean your commands are indistinguishable from normal mesh traffic to anyone not holding the key.
How it works
The attack chain
Deploy the implant
Plug MIA into the target via USB. It enumerates as a keyboard — no drivers, no prompts.
Send a command
From any stock Meshtastic node, (or another MIA), send a message prefixed with !mia: on the shared channel.
Mesh delivers it
The LoRa mesh routes the encrypted packet to the implant — through walls, across floors.
Target executes
MIA decrypts using AES and injects the DuckyScript payload as USB keystrokes.
Features
Built for the field
AES-128 & AES-256
Full Meshtastic channel PSK support. Set any private channel key — 128-bit or 256-bit — and change it at runtime without reflashing.
Long-range LoRa
SX1262 radio with configurable spread factor, bandwidth, and TX power. Works with any Meshtastic node on the same frequency.
DuckyScript
Full USB HID keyboard injection. STRING, DELAY, GUI, CTRL, ALT, modifier combos — chain multiple commands in one packet.
Web dashboard
Configure radio parameters, PSK, and WiFi from any browser. Served directly from the device over its own WPA2-secured AP.
Persistent config
All settings survive reboots via NVS flash storage. Set your channel key once — it stays across power cycles.
Serial CLI
Full Metasploit-style command interface over USB serial. Configure everything without opening a browser.
Hardware
Custom USB-A form factor
The MIA PCB v1 is a custom board designed to disappear. Built in a USB-A form factor, it plugs directly into any USB-A port and looks like a flash drive sitting in a machine.
- ESP32-S3-WROOM-1 (N16R8) — 16MB flash, 8MB PSRAM
- E22-900M30S — SX1262-based LoRa, 30dBm
- AMS1117-3.3 LDO regulator
- Hirose DM3AT MicroSD slot
- USB-A connector — USB A Male connector or gold-plated PCB contacts
In practice
One message, any target
!mia: STRINGLN hello from the mesh
# The target machine types:
hello from the mesh
# Chain commands with commas:
!mia: GUI r, DELAY 500, STRINGLN cmd, ENTER
# Or configure the implant over serial:
mia> set psk ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef==
[+] 128-bit PSK applied — ok
mia> get config
Frequency: 906.875 MHz
Spread Factor: 11
TX Power: 22 dBm
Open source hardware
KiCad schematics and gerbers included
The full hardware design — schematics, PCB layout, gerbers, and bill of materials — is available in the repo. Order your own from any PCB fab.
MIA v1 has a known routing issue on the LoRa module. v2 is in development with corrected MOSI/MISO routing, BOOT and RESET buttons, and a cleaner layout.
Supported hardware
Works on what you have
Heltec WiFi LoRa 32 V3
Reference platform. Tested and confirmed. Flash from the browser in 30 seconds.
MIA PCB v1
Custom USB-A implant form factor. v2 in development with hardware fixes.
LilyGo T3-S3
Native USB HID over a single cable. Support in active development.
Get started
Flash in 30 seconds
No software install required. Plug in your device and flash from the browser.