TrojPix Attack Uses Imperceptible Pixels to Steal Data From Air-Gapped Networks

A newly disclosed electromagnetic (EM) covert-channel attack called TrojPix exploits invisible pixel modulation to exfiltrate data from air-gapped networks at unprecedented speed and range.

The research, documented by USENIX Security, shows that air-gapped systems widely deployed in military command centers, government agencies, financial institutions, and nuclear power control systems are not as isolated as assumed.

TrojPix demonstrates that malware running with only user-mode privileges can turn an ordinary digital video cable into an unintended antenna, leaking sensitive files to an attacker positioned up to 208 meters away.

TrojPix Attack Uses Imperceptible Pixels

TrojPix exploits the fact that pixel values transmitted over Transition-Minimized Differential Signaling (TMDS), the encoding scheme used in HDMI and similar digital video interfaces, generate high-speed switching currents that inevitably radiate EM energy along the cable.

By making subtle, imperceptible modifications to the least significant bits of color channels, the malware can deterministically shape this “unintentional” emission into a controllable signal, effectively repurposing the cable as a software-defined radio without requiring administrator rights, driver installation, or hardware tampering.

The system uses a technique called Pixel-to-Sample Mapping (P2S-Map), which precisely aligns two-dimensional pixel blocks with one-dimensional receiver sampling instants, allowing data rates that approach the receiver’s sampling rate.

On the receiver side, a matched-filter correlation module handles synchronization, an HDMI-boundary-aware detector locates row boundaries, and an adaptive decision threshold (ADT) compensates for signal degradation over distance together enabling robust decoding even under noise and jitter.

TrojPix operates through two distinct delivery methods, both designed to leave zero visible trace on the victim’s screen.

• Fake screen-off mode: The malware disguises the display as powered down, presenting a black screen indistinguishable from standby, while the video cable secretly continues transmitting data; it halts instantly if user interaction is detected.
• Foreground embedding mode: Covert data is woven directly into the content currently on-screen through minute pixel or color adjustments, while remaining usable during normal computer operation.

A subjective study of 50 volunteers found that none could perceive any visual difference between the modes, and quantitative image-similarity scores (SSIM values of 0.998–0.999) confirmed near-perfect visual fidelity.

Usenix Security tested across nine COTS monitor brands (Dell, Samsung, LG, AOC, Philips, Lenovo, TCL, Huawei, and Redmi) and fifteen digital video cables from multiple manufacturers; TrojPix achieved an average bit correct rate above 99% and, after error correction, 100% accuracy in most configurations.

The attack also penetrated a 30 cm-thick concrete wall with only a marginal accuracy drop (99.96% to 99.14%), and remained resilient against multiple nearby active monitors and various EM shielding materials, though tinned-copper shielding was the most effective countermeasure tested.

TrojPix successfully transferred file payloads up to 10 MB with 100% bit and character accuracy, confirming practical viability for real-world data exfiltration.

Mitigation

The USENIX recommend a layered defense: Faraday-cage-style EM shielding around cables and components, deployment of RF interference equipment to jam the target frequency band, and longer-term migration to EM-leakage-free interfaces such as fiber-optic video links.

They also suggest randomizing TMDS transmission sequences and applying pixel-smoothing algorithms to minimize exploitable bit-flip patterns, though both add implementation cost and complexity.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.