New TrojPix Attack Leaks Data From Air-Gapped Systems via Video Cable Emissions

Researchers at Shandong University have shown a fast new way to pull data off computers that are cut off from every network. The technique, called TrojPix, tweaks on-screen pixels in ways the eye cannot see, so that the video cable carrying them radiates a faint radio signal a nearby receiver can decode. But TrojPix works only once malware is already on the target machine, so it

The article describes *TrojPix*, a covert channel for exfiltrating data from air‑gapped systems by subtly modulating on‑screen pixels so that video cables emit radio signals that can be decoded by a nearby receiver. This fits within known classes of air‑gap attacks where malware encodes information into electromagnetic or optical emissions from components such as GPUs, monitors, or cables.[3][5][6] The report’s key fact is that TrojPix still requires prior malware infection of the isolated machine, so it is a data‑exfiltration *amplifier* rather than an initial intrusion vector. From a CyberSE.AI standpoint, this underscores that air‑gapped environments used with AI workloads (e.g., sensitive model inference or offline training) can still suffer data leakage via side channels, so organizations should test for such paths with targeted red‑teaming, enforce strict removable‑media and supply‑chain controls, and treat physical zoning, emanation controls, and device bans (e.g., nearby phones/receivers) as part of AI security architecture rather than relying on network isolation alone.[5][6]