Researchers at Shandong University found a fast way to pull data off computers that aren’t connected to any network. The technique, called TrojPix, tweaks on-screen pixels in ways the eye can’t see. The video cable carrying them radiates a faint radio signal a nearby receiver decodes.
Here’s the catch — TrojPix only works once malware’s already on the target machine. It’s an exfiltration channel, not an infiltration one. The researchers hit a peak throughput of 8.1 Mbps, reaching as far as 208 meters in testing. That’s roughly a megabyte per second.
Most air-gap covert channels crawl along at bits or kilobits per second. At 8.1 Mbps, TrojPix could move a 100 MB file in under two minutes. That turns the threat from leaking a password into moving whole files while the monitor looks switched off.
The method doesn’t need admin rights or hardware changes. User-level malware that can draw to the screen is enough. The team tested it across nine monitor brands and fifteen video cables.
Two hiding techniques: one fakes a powered-off display, keeping the screen dark while it transmits. The other buries the signal in whatever’s already on screen.
You can’t patch away the emission itself. Countermeasures are physical — fiber-optic video links instead of copper, shielded cables, TEMPEST-rated facilities. And above all, keep malware off the machine. Without that foothold, TrojPix has nothing to send.
TrojanPix was presented at USENIX Security ’26.
