TrojPix Exfiltrates Data From Air-Gapped PCs via Video Cable Radio

Researchers from Shandong University have unveiled TrojPix, a covert-channel attack that transforms ordinary video cables into radio transmitters capable of stealing data from computers completely disconnected from any network. The technique achieves transfer rates of 8.1 Mbps—fast enough to exfiltrate a 100 MB file in under two minutes—and works through concrete walls at distances up to 208 meters.

The attack targets air-gapped systems, machines deliberately isolated from networks to protect classified information in military installations, government agencies, financial institutions, and critical infrastructure facilities like nuclear power plants. These systems have long been considered one of the most secure computing environments, but TrojPix demonstrates that physical isolation alone cannot guarantee protection.

How TrojPix Works

The technique exploits electromagnetic emissions naturally produced by video cables carrying display signals. By making microscopic, imperceptible modifications to pixel values—such as altering the least significant bit of the blue channel—malware running on a compromised system can deterministically modulate these emissions. A nearby attacker with off-the-shelf radio equipment can then decode the signal and reconstruct the transmitted data.

What makes TrojPix particularly concerning is its accessibility. The malware requires no administrator privileges and runs entirely in user mode. Any software capable of drawing to the screen—even a simple application—could theoretically implement this attack.

The researchers identified two concealment approaches. In the first, the malware simulates a powered-off display while transmitting in complete darkness, making the attack invisible to anyone observing the monitor. In the second, the malware embeds transmission signals within ordinary on-screen content, hiding the exfiltration in plain sight during normal computer use.

Why Air-Gapped Systems Matter

Organizations deploy air-gapped systems specifically because the data they handle cannot tolerate any risk of network-based exfiltration. Intelligence agencies store classified documents on them. Financial institutions isolate trading algorithms. Industrial control systems managing power grids and water treatment facilities remain disconnected to prevent remote tampering.

Previous research has demonstrated various side-channel attacks against air-gapped systems—using acoustic signals, LED blinks, or thermal emissions—but these typically achieved data rates measured in bits per second. TrojPix's megabit-per-second throughput represents roughly a 27-fold improvement over prior state of the art, making it practical for stealing substantial amounts of data rather than just cryptographic keys.

The 208-meter range also exceeds what most facilities plan for when designing physical security perimeters. An attacker parked outside a building or positioned in an adjacent office could potentially receive transmissions from a compromised air-gapped system deep inside the target facility.

Broad Hardware Compatibility

Testing confirmed the attack works across nine monitor brands and fifteen distinct video cable types, including HDMI, DisplayPort, and older VGA connections. This broad compatibility suggests the technique exploits fundamental physics of how video signals generate electromagnetic emissions rather than vulnerabilities specific to particular hardware.

The researchers will present their full findings at the 35th USENIX Security Symposium, scheduled for August 2026. Their paper includes detailed technical specifications that security teams can use to understand the threat, though this same information could enable malicious implementations.

Defending Against Pixel-Based Exfiltration

Countermeasures for TrojPix focus on physical and preventive controls rather than software patches:

1. Use fiber-optic video cables - Unlike copper cables, fiber optics don't emit exploitable electromagnetic radiation
2. Implement electromagnetic shielding - Faraday cages and shielded rooms can block radio emissions from reaching external receivers
3. Extend physical security perimeters - The 208-meter range may require expanding controlled zones around sensitive facilities
4. Prevent initial compromise - Since the attack requires malware already on the target system, maintaining strict software controls and supply chain integrity remains the first line of defense

For organizations running air-gapped systems, TrojPix serves as a reminder that "isolated" doesn't mean "invulnerable." The researchers responsible for this work previously developed similar covert channel techniques demonstrating that determined attackers continue finding creative ways to bypass physical security controls.

What Security Teams Should Do

If your organization maintains air-gapped systems, conduct a risk assessment against electromagnetic exfiltration threats. Review the physical placement of sensitive systems relative to building perimeters and adjacent spaces. Consider whether current shielding measures account for attacks operating at frequencies and data rates TrojPix demonstrates.

The transition to fiber-optic display connections, where practical, eliminates this entire attack surface. For systems where copper video cables must remain, enhanced monitoring of the electromagnetic spectrum around sensitive areas could potentially detect transmission attempts, though this requires specialized equipment and expertise.

Air gaps remain a valid security control, but they're not magic. As TrojPix shows, the gap only works if you also control what crosses it invisibly through the air.