TrojPix: Electromagnetic Covert Channels via Imperceptible Pixel Modulation

Air-gapped networks rely on physical isolation to prevent external connectivity. Prior electromagnetic (EM) covert channels have exploited emissions from video cables, memory buses, and CPUs, yet they rarely achieve high throughput, long range, and visual imperceptibility simultaneously, limiting practical utility in air-gapped settings. We show that imperceptible pixel modulation can deterministically induce controllable EM emissions on digital video cables, enabling control without system privileges or hardware modifications. Building on this insight, we present TrojPix, a covert channel that maintains on-screen imperceptibility while delivering high-speed, long-range communication over digital video cables. We realize a lightweight communication scheme that combines pixel-to-sample mapping with adaptive decoding, enabling sample-rate-level robust communication over extended ranges. We evaluate TrojPix across nine commercial-off-the-shelf (COTS) monitor manufacturers and fifteen COTS digital video cables under realistic conditions, demonstrating its effectiveness in two attack modes: fake screen-off and foreground embedding. TrojPix achieves a peak throughput of 8.1 Mbps and a maximum range of 208 m, revealing a practical and stealthy threat to the security of air-gapped networks.