Can a USB mouse jiggler be detected? What IT actually sees

What a USB jiggler actually is

A jiggler dongle is a plain USB device that identifies itself to the operating system as a mouse — an ordinary HID pointing device — and sends a small, repeating movement or click signal on a timer. Some are a bare stick you plug into a port; others sit under a real mouse and physically nudge it. Either way there is no installer, no background process, and no admin prompt: the system simply sees another pointing device appear.

That design is the whole appeal. A monitoring agent that scans running processes and installed programs has nothing new to find, because a jiggler never becomes a process. This is the part of the sales pitch that genuinely holds up, and it is worth stating plainly before looking at where it breaks down.

• No installer and no admin rights.
• Presents itself as a standard mouse (HID device).
• One repeating movement or click on a fixed timer.

What "undetectable" really covers

The word undetectable does a lot of quiet work in jiggler marketing. What it honestly means is "does not appear in the list of installed software" — and only that. It does not mean the device is absent from hardware logs, and it says nothing about how the movement looks once it reaches the tracker.

A time tracker and an endpoint-management tool look at completely different layers of the machine. Conflating "no software to scan" with "nothing to see" is the core mistake behind the pitch, and it is exactly the mistake the marketing relies on you making.

The hardware still leaves a trace

Plugging in a USB device is an event the operating system records, complete with a timestamp and the identity the device reported. On a managed work laptop, connected peripherals are commonly inventoried by endpoint-management software, so a second "mouse" that appears every morning and disappears every evening can sit in a device list long before anyone glances at an activity percentage.

None of this is a tracker reading your intentions; it is ordinary asset management. But it means the hardware route is not the clean disappearance it is sold as, particularly on a company-owned machine you do not fully control.

• USB connect and disconnect events are timestamped.
• Managed machines often inventory attached peripherals.
• A device that reports as a mouse can still stand out by its name or its pattern of use.

The real giveaway is the input pattern

A time tracker does not look at your USB port. It records input events and the active window, then scores what it saw. From that vantage point a hardware jiggler produces a very particular fingerprint: the cursor travels the same short path, at the same interval, forever, with no clicks and no relationship to whatever is on the screen.

No single one of those traits is damning on its own, but together they form exactly the shape monitoring vendors describe when they explain their anomaly detection. A person's input is messy; a dongle's is metronomic, and the evenness is the tell.

• One repeating path at one steady interval.
• Movement with no clicks at all.
• No link to the active window or on-screen content.

What a detector actually looks for

Several trackers state, in general terms, that they flag "automated" or "unusual" activity. In practice that means statistics on the rhythm of input rather than any inspection of your hardware: movement that is too regular, long stretches of motion with zero clicks or keystrokes, and intervals that are near-identical to one another. Time Doctor's unusual-activity reporting and similar features in other tools all sit on this same idea.

The important consequence is that "can they detect a USB jiggler?" is really the question "does this input look like a person?" A dongle fails that test not because it is hardware but because it is repetitive. Anything equally repetitive fails it too — software movers included.

Hardware versus software: the same test

People often assume a software mouse mover is the safer choice because it avoids the device list, and a hardware dongle the safer choice because it avoids the process list. Both framings miss the point: whichever layer you dodge, the tracker still judges you on the shape of the input. A crude software mover that drags the cursor along one line at a fixed interval draws the same suspicious fingerprint as a crude dongle.

So the real division is not hardware versus software. It is repetitive versus varied. A tool that only knows how to nudge the cursor on a timer will look mechanical no matter how it is packaged.

What input does not form that signature

Input escapes the mechanical fingerprint when it stops being periodic. That means paths and speeds that change from one move to the next, genuine pauses that fall between actions rather than on a clock, and a mix of signals — keystrokes, scrolling and the occasional window switch — instead of pure cursor drift. It also means aiming for a natural mid-range activity band rather than a flat line pinned at the top of the scale, because an unbroken 100% is its own kind of red flag.

This is the behaviour Reaction is built to produce, and it is worth being honest about the ceiling: varied, human-like input can look like a person taking a normal break, but no tool can promise a specific tracker will never notice — and we do not make that promise.

• Variable curves and speeds, not one loop.
• Real pauses between actions.
• Keys and scrolling, not movement alone.
• A mid-range band, not a flat 100%.

Where Reaction fits

Reaction is a presence (anti-idle) tool for one narrow situation: the stretches when you have stepped away from the keyboard but the session should stay alive — the coffee, the stretch, the school run. It moves the cursor along changing curves, keeps a living keyboard rhythm, scrolls and switches windows now and then, and holds a natural activity level inside a range you set instead of a flat maximum. Crucially, it runs only while the machine is genuinely idle and hands control back the instant you touch the mouse.

That last limit is the honest one: Reaction cannot make low-input work look like high-input work while you are actually at the desk, because it steps aside the moment you are there. What it does is keep an ordinary break from reading as an absence. Use it within your agreements and your company's policy — see the acceptable-use note below.