TrojPix is a new, ultra-fast method for extracting data from computers that are completely isolated from networks — so-called air-gapped systems . Researchers at Shandong University have demonstrated the technique, which modifies pixels on the screen in a way that is invisible to the human eye, by forcing the video cable to emit a weak radio signal that can be decoded by a nearby receiver. The discovery highlights how difficult it is to fully protect even the most isolated computer systems.
TrojPix only works after malware is already installed on the target, meaning it serves as a channel to extract stolen data rather than a method of infiltration. In tests, TrojPix achieved a maximum transfer rate of 8.1 Mbps and was effective at distances of up to 208 meters — measurements taken separately. For comparison, most covert channels for air- gapped systems operate at speeds of bits or kilobits per second.
See also: PIXHELL: Steals data from Air-Gapped computers
At 8.1 megabits — about one megabyte per second — TrojPix could transfer a 100MB in less than two minutes. This radically transforms the risk: it’s no longer just about leaking a password, but about potentially transferring entire files while the screen appears to be off. The practical significance of this performance is enormous for organizations that handle highly sensitive information.
How TrojPix works: The imperceptible pixel modulation technique
The technique the researchers describe is called imperceptible pixel modulation. It doesn't require root privileges or hardware modifications — all it requires is malware that can render graphics on the screen. The researchers describe two methods of hiding the transmission: the first simulates a black screen, keeping it dark while transmitting data, and the second embeds the signal within the existing content on the screen, allowing the normal visual elements to "carry" the data silently.
The team reported successful operation on nine different brands of monitors and fifteen types of video cables, demonstrating that the technique is not limited to a specific hardware configuration. This broad compatibility makes TrojPix particularly concerning, as it cannot be addressed simply by changing equipment. Real-world effectiveness may vary, as a receiver must deal with obstacles such as walls, shielding, and environmental noise.
The idea of using a video cable as a covert transmitter is not new — it has its roots in the much-studied phenomenon of compromising emanations , known as TEMPEST . More recent work, such as TEMPEST-LoRa , has used similar techniques to communicate with LoRa radios — a widely used long-range wireless communication standard. While TEMPEST-LoRa achieved a maximum range of 87.5 meters at 21.6 kbps , TrojPix's maximum throughput is significantly higher.
See also: SmartAttack steals data from air-gapped systems via smartwatches
TrojPix and air-gapped attacks: Historical context and practical impact
To date, real-world attacks on air-gapped systems — such as the infamous Stuxnet and Agent.BTZ — have relied primarily on USB drives to transfer data rather than radio signals. TrojPix and similar methods show the potential for such attacks, even if they have not been widely observed in practice. It is worth noting that another screen-based data extraction method, PIXHELL, reported in 2024, used the sound emitted by the screen to leak information from an air-gapped computer.
Other techniques have included extracting data from Ethernet using embedded hardware—a method that TrojPix completely bypasses, as it requires no physical intervention in the hardware. This makes it particularly dangerous for high-security environments such as government facilities, nuclear plants, industrial control systems (ICS/SCADA), and military networks, where physical isolation is considered the last line of defense.
According to The Hacker News, the broadcast channels remain experimental for now, but the speed and reach demonstrated by TrojPix make it one of the most worrying academic demonstrations of air-gapped system security in recent years.
Protection from TrojPix: What organizations can do
Preventive measures against such emissions are basically natural. The use of fiber optics for video transmission is an effective solution, as they do not emit such signals. In addition, shielding cables and rooms (Faraday cage) can significantly reduce the risk. However, the most critical measure remains from being installed malware on machines, as TrojPix depends on the presence of malware to function.
See also: ScarCruft uses Zoho WorkDrive and USB malware to compromise air-gapped networks
Organizations that handle highly sensitive data should review their security policies, implement strict access controls on air-gapped systems, and invest in anomaly detection technologies. The TrojPix research is a reminder that physically isolating a system is not enough on its own — a holistic approach to cybersecurity is essential, especially in an era when attackers are exploring increasingly sophisticated data exfiltration channels.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
