# TrojPix: New Covert Channel Leaks Data From Air-Gapped Systems at Megabit Speeds via Video Emissions
Researchers at Shandong University have unveiled a sophisticated technique for exfiltrating data from air-gapped computers—systems intentionally isolated from networks—by weaponizing an overlooked vulnerability in video cable emissions. The attack, dubbed TrojPix, uses imperceptible pixel modulation to encode data into screen display signals, allowing nearby adversaries to intercept sensitive information wirelessly without network access.
The finding represents a dramatic leap in the speed and practicality of covert channel attacks, reaching throughput rates hundreds of times higher than previous demonstrations while requiring no hardware modifications or administrative privileges.
## How TrojPix Works
TrojPix operates on a deceptively simple principle: when video cables transmit pixel data to monitors, the electromagnetic emissions radiating from those cables can be decoded by a nearby radio receiver. Rather than accepting this as an inevitability of physics, the researchers turned it into a weaponized exfiltration vector.
The Technical Approach:
The attack modulates video output in ways imperceptible to human viewers. Malware already present on a target system can alter pixel values on screen in patterns that appear normal to the eye but encode exfiltrated data in the electromagnetic signature of the video cable. The researchers describe this as imperceptible pixel modulation—changes so subtle that they're invisible to observation but detectable by specialized radio equipment.
The technique requires only user-level malware that can access the screen framebuffer. No administrator rights are necessary. No hardware changes, no network access, no physical implants: just software already running on a compromised machine.
Two Concealment Methods:
The researchers demonstrated two ways to hide the exfiltration traffic:
1. Dark Display Mode: The malware can fake a powered-off display while simultaneously transmitting data via pixel modulation. To an observer, the screen appears dark and dormant; in reality, covert data is flowing.
2. Signal Embedding: The malware can bury the encoded data in legitimate screen content—normal windows, applications, and visuals that are already on display. The payload rides alongside ordinary video output, making detection through visual inspection impossible.
## Performance Metrics: Speed and Range
The lab results are striking. TrojPix achieved a peak throughput of 8.1 Mbps (roughly 1 megabyte per second) and a maximum range of 208 meters. These figures were measured separately under different laboratory conditions rather than simultaneously, meaning real-world conditions will likely degrade performance.
To contextualize this speed: traditional air-gap covert channels operate at bit or kilobit rates. At 8.1 Mbps, TrojPix could exfiltrate a 100 MB file in under two minutes—potentially before a defender notices unusual activity on the target system.
Comparison to Prior Work:
| Technique | Throughput | Range | Year | Method |
|-----------|-----------|-------|------|--------|
| TEMPEST-LoRa (CCS 2025) | 21.6 kbps | 87.5 m | 2025 | Video cable emissions to LoRa radio |
| PIXHELL (2024) | Slower | Shorter | 2024 | Sound emission from display itself |
| TrojPix (2026) | 8.1 Mbps | 208 m | 2026 | Imperceptible pixel modulation |
TrojPix's throughput advantage is hundreds of times higher, though direct comparison is complicated by different receiver equipment and laboratory conditions.
## Scope of Vulnerability
The researchers validated TrojPix across nine monitor brands and fifteen different video cable types, demonstrating that the vulnerability is neither a quirk of specific hardware nor a niche edge case. The attack is generalizable across common, off-the-shelf displays and cables—the kind found in most organizations.
The lack of hardware specificity is significant. Organizations cannot defend themselves by switching vendors or cable brands; the underlying physics of video signal transmission creates the vulnerability universally.
## Technical Context: The TEMPEST Legacy
TrojPix is not the first technique to exploit compromising emanations—electromagnetic signals inadvertently leaked by computing equipment. The field traces back decades to TEMPEST research, classified studies conducted by the U.S. National Security Agency on eavesdropping methods targeting electronic systems.
What was once exotic, classified knowledge has gradually been reverse-engineered and published. Recent work in the academic security community has increasingly focused on practical demonstrations of TEMPEST-like attacks. TrojPix represents a significant milestone in making these attacks fast enough to be operationally useful.
Previous air-gap breaches—from Stuxnet to Agent.BTZ—crossed the isolation boundary using USB drives as the delivery and exfiltration vector. TrojPix shows that wireless exfiltration can now rival or exceed USB-based channels in speed and convenience, without requiring any physical interface.
## Operational Implications
TrojPix requires a critical precondition: malware must already be present on the target system. It is not an infection vector; it is an exfiltration vector.
This constraint is important but not reassuring:
For well-resourced adversaries (state-sponsored groups, organized crime with technical depth), TrojPix changes the risk calculus. An air-gap, once breached, becomes a permeable membrane rather than a true barrier.
## Defense and Mitigation
The vulnerability lies in the physics of video transmission and cannot be patched away through software. Defenders must implement physical and preventive controls:
Recommended Countermeasures:
For most organizations, the practical takeaway is not "install fiber-optic cables," but rather: a compromised air-gap is not a contained breach. Invest in preventing initial compromise, detect and respond to intrusions rapidly, and assume that if malware reaches a sensitive system, data can move out faster than previously thought.
---
## HackWire Analysis
TrojPix highlights a recurring lesson in security: physics constrains what is possible, but creativity in exploitation determines what is *practical*. For decades, the theoretical risk of electromagnetic emissions from video cables was known to researchers and classified agencies. What was theoretical has now become demonstrated, reproducible, and scalable.
The speed improvement—from kilobits to megabits—is not merely quantitative; it is strategically significant. At kilobit speeds, exfiltration is detectable through anomaly monitoring: a system pulling terabytes across a covert channel over months triggers alerts. At megabit speeds, a multi-gigabyte dataset disappears in minutes. The operational window for detection collapses.
More concerning is the generality of the attack. It requires no exotic hardware, no insider knowledge of a specific vendor's implementation, no rare vulnerabilities. Any malware with framebuffer access—a privilege granted to ordinary graphical applications on systems with a GUI—can implement TrojPix. The barrier to entry for a sophisticated attacker has lowered.
The real-world impact depends on how TrojPix might be deployed alongside other tradecraft. State-sponsored groups, in particular, have demonstrated the ability to penetrate air-gapped networks via supply chain compromise (SolarWinds, Ivanti) and then exfiltrate data at scale. A group that already has code execution inside the perimeter now has a faster exit channel.
What TrojPix reveals is that the era of "air-gap as ultimate boundary" is ending. Organizations protecting the most sensitive data should operate on the assumption that a sufficiently determined and resourced adversary can achieve both initial compromise and reliable exfiltration. That shifts the burden to detection, response speed, and forensic capability. The defense cannot rely on isolation alone; it must embrace assume-breach mentality and focus on rapid threat hunting and incident response.
— HackWire Editorial
---
## Recommendations for Defenders
Immediate Actions:
Long-Term Strategy:
---
## Related Coverage