TrojPix Attack Leaks Air-Gapped Data via Video Cable Emissions

Researchers at Shandong University have unveiled TrojPix, a covert channel technique that exfiltrates data from air-gapped systems by modulating imperceptible pixels on the screen to generate faint radio emissions from the video cable. The method requires no administrative privileges and no hardware modifications—only user-level malware capable of drawing to the display. Once infected, the target machine transmits stolen data to a nearby radio receiver, bypassing traditional network-based monitoring entirely. The attack represents a significant evolution in TEMPEST-style compromising emanation research, pushing the technique from theoretical curiosity toward practical data exfiltration speeds.

In lab tests, TrojPix achieved a peak throughput of 8.1 Mbps and a maximum range of 208 meters, though the researchers measured these two figures separately rather than simultaneously. At roughly a megabyte per second, a 100 MB file could be transmitted in under two minutes—a stark contrast to most air-gap covert channels that crawl along at mere bits or kilobits per second. The technique uses two hiding methods: one simulates a powered-off display while secretly transmitting, and the other embeds the signal within ordinary on-screen content. The team confirmed compatibility across nine monitor brands and fifteen video cable types, suggesting broad applicability. Defenders should note that maintaining strong credential hygiene remains the first line of defense; users can verify their exposure with a password checker and review their overall posture with a privacy checkup.

TrojPix builds on a lineage of emission-based exfiltration research, including the 2025 TEMPEST-LoRa work that reached off-the-shelf LoRa radios at distances up to 87.5 meters with throughputs of 21.6 kbps. While TrojPix's peak speed is hundreds of times higher, the two use different receivers and test conditions, making direct comparison difficult. Other air-gap research includes PIXHELL, which used display-generated audio for data leakage, and attacks that have exfiltrated data via Ethernet hardware implants. Real-world air-gap breaches in the wild—Stuxnet and Agent.BTZ—have historically crossed the gap using USB drives rather than radio, meaning TrojPix remains a research demonstration rather than an observed threat. Securing communications with modern encryption protocols, which can be verified using an SSL/TLS checker, adds another layer to a defense-in-depth strategy.

The fundamental challenge is that compromising emanations cannot be patched away at the software level. Effective countermeasures are physical and preventive: deploying fiber-optic video links instead of copper to eliminate conductive emissions, applying cable and room shielding in TEMPEST-rated facilities, and enforcing strict air-gap policies around removable media. Above all, preventing malware from gaining a foothold on the target machine neutralizes TrojPix entirely—without that initial compromise, the technique has nothing to exfiltrate.