TrojPix: New EM Covert-Channel Attack Exfiltrates Data from Air-Gapped Networks at Unprecedented Speeds Researchers at USENIX Security have unveiled TrojPix, a novel electromagnetic (EM) covert-channel attack that exploits invisible pixel modulation to steal data from air-gapped systems networks physically isolated from external connections. The technique turns standard digital video cables into unintended antennas, enabling malware to leak sensitive files to attackers up to 208 meters away without requiring admin privileges, hardware modifications, or visible traces. ### How TrojPix Works TrojPix leverages Transition-Minimized Differential Signaling (TMDS), the encoding scheme used in HDMI and similar interfaces, which generates EM emissions during pixel transmission. By subtly altering the least significant bits of color channels, the malware shapes these emissions into a controllable signal, effectively repurposing the cable as a software-defined radio. Key technical features include: - Pixel-to-Sample Mapping (P2S-Map): Aligns 2D pixel blocks with receiver sampling to maximize data rates. - Matched-filter correlation & adaptive thresholding: Ensures robust decoding despite noise, jitter, and distance. - Two stealth modes: - Fake screen-off: Displays a black screen while secretly transmitting data, halting if user interaction is detected. - Foreground embedding: Embeds covert data into on-screen content via imperceptible pixel adjustments. A study of 50 volunteers found no detectable visual differences, with SSIM scores of 0.998–0.999 confirming near-perfect fidelity. Testing across nine monitor brands (Dell, Samsung, LG, etc.) and 15 cable types achieved >99% bit accuracy, with 100% payload integrity for files up to 10 MB. ### Performance & Real-World Impact TrojPix outperforms prior EM exfiltration methods, including: - Peak throughput: 8.1 Mbps (vs. 300 kbps for BitJabber). - Max range: 208 meters (vs. 87.5 m for Tempest-LoRa). - Stealth: Fully imperceptible (unlike visually detectable prior attacks). The attack penetrated a 30 cm-thick concrete wall with minimal accuracy loss (99.96% → 99.14%) and remained effective against EM shielding, though tinned-copper shielding proved most effective. It also evaded interference from nearby active monitors. ### Mitigation Recommendations USENIX suggests layered defenses, including: - Faraday-cage-style EM shielding around cables and components. - RF jamming of target frequency bands. - Migration to fiber-optic video links to eliminate EM leakage. - Randomized TMDS sequences and pixel-smoothing algorithms to disrupt exploitable patterns (though these add complexity). TrojPix exposes a critical vulnerability in air-gapped systems, which are widely used in military, government, financial, and nuclear control environments, challenging the assumption of their invulnerability to remote exfiltration.

Cybersecurity Roundup: Zero-Days, AI Threats, and Massive Exploits Dominate July 2026 This week’s cybersecurity landscape underscored the relentless expansion of attack surfaces, with high-impact vulnerabilities, active exploits, and emerging threats targeting everything from enterprise identity systems to AI-driven workflows. Microsoft’s Patch Tuesday Highlights Critical Exploits Microsoft’s July 2026 Patch Tuesday addressed 570 vulnerabilities, including two actively exploited zero-days: - CVE-2026-56164 (SharePoint Server): Allows remote code execution (RCE) via crafted requests. - CVE-2026-56155 (Active Directory Federation Services): Enables privilege escalation, posing risks to enterprise identity infrastructure. A BitLocker bypass bug (publicly disclosed) and a Windows User Profile Service exploit (LegacyHive PoC) further exposed post-patch risks, allowing standard users to hijack registry hives. WordPress Under Siege: 500M Sites at Risk A pre-authentication RCE flaw (wp2shell, CVE-2026-60137/CVE-2026-63030) in WordPress’s REST API batch-route functionality threatens over 500 million sites, enabling unauthenticated takeovers via SQL injection. The vulnerability remains unpatched for many deployments. Big Four Breach: EY Confirms Client Data Exposure Ernst & Young disclosed a breach between March 28 and April 12, 2026, where an unauthorized third party accessed its IT support ticket platform, exfiltrating client tax and investment documents. Detection lagged nearly three weeks, raising concerns about incident response in professional services firms. AI Systems Emerge as New Attack Vectors Adversaries are increasingly targeting AI integrations: - Claude for Chrome: A flaw in the browser extension exposed users to potential data theft. - GhostCommit: A novel technique hides malicious AI prompts within code commits, manipulating coding assistants undetected. - GPT-5/6 Exploit Chain: Researchers demonstrated an attack pairing AI models ("Sol") with Chrome vulnerabilities, signaling a shift toward AI-assisted cyberattacks. Malicious Extensions and Supply Chain Risks - ModHeader: A popular Chrome/Edge extension (1.6M installs) was removed after dormant code was found exfiltrating browsing history to an external server. - 7-Zip: A critical flaw enables code execution via crafted archives, impacting widespread file-handling workflows. - Notepad++ v8.9.7: Patched multiple high-risk bugs, including PowerShell command injection and Zip Slip path traversal. Enterprise and Cloud Threats Persist - Dell: Two separate issues emerged BIOS firmware flaws exposing admin passwords and a July 2026 update causing unexpected laptop shutdowns. - Fortinet/F5/Splunk: Vendors released patches for 10+ vulnerabilities, including Nginx-related flaws (F5) and data-integrity risks (Splunk). - AWS Cost Explorer: A bug introduced security and data-exposure risks for cloud billing monitoring. - TP-Link Cameras: A flaw could allow attackers to compromise device functionality or access video feeds. The week’s disclosures reflect a broadening threat landscape, where legacy systems, AI tools, and third-party integrations remain prime targets for exploitation.

Dell Data Breach Claims Under Scrutiny After Fake Records Surface Cybernews researchers have cast doubt on the legitimacy of a purported Dell database breach, which allegedly exposed over 5,000 records, including emails from more than 2,000 employees. The incident, attributed to an attacker using the alias ShinyCorporation a name linked to the notorious Scattered Lapsus$ Hunters hacking collective has raised concerns about the accuracy of the leaked data. Analysis of a sample of 21 emails from the dataset revealed that at least 20% were fake, suggesting the breach may have been exaggerated. While some legitimate emails were included, researchers warned these could be exploited for follow-up cyberattacks, such as phishing or credential-stuffing campaigns. Additionally, leaked IP addresses and internal URLs if authentic could enable reconnaissance efforts, potentially exposing source code and internal business operations. The findings highlight the risks of unverified breach claims, particularly when threat actors may inflate or fabricate data to amplify their impact.

Dell has confirmed that criminals broke into its IT environment and stole some of its data — but told The Register that it's 'primarily synthetic (fake) data.' The compromised data, according to WorldLeaks' post, includes 416,103 files. The data stolen is primarily synthetic, publicly available or Dell systems/test data. This follows a more serious breach last year, during which a digital thief claimed to have stolen and put up for sale a database containing 49 million Dell customer records.

Nike Targeted in WorldLeaks Ransomware Attack, Data Extortion Threatened Nike has fallen victim to a data extortion attack by the financially motivated ransomware group WorldLeaks, which announced the breach on its darknet leak site on January 22, 2026. The group threatened to release stolen data by January 25, 2026, at 6 PM GMT, though the exact volume of exfiltrated information remains unconfirmed. Industry analysts estimate it could reach several terabytes, based on the group’s past attacks. Nike acknowledged the incident in a statement, confirming it is actively investigating the breach. According to reports, the attack compromised: - 481,183 user accounts - 220 employee records - 444 third-party credentials Potentially exposed data includes internal documentation, customer information, employee contact details, operational records, and HR data. The full scope of sensitive material such as intellectual property or financial records remains under investigation. WorldLeaks, a rebrand of Hunters International (active since January 2025), operates an extortion-only model, focusing on data theft rather than encryption to evade detection. The group maintains a four-platform infrastructure, including a public leak site, negotiation portal, and an "Insider" journalist platform for early data access. Since its formation, WorldLeaks has claimed 116 victims, including Dell Technologies (1.3TB stolen) and L3Harris Technologies, a U.S. defense contractor. Initial access is typically gained through phishing, unpatched applications, or VPNs without multi-factor authentication (MFA). Post-compromise, the group uses credential theft, lateral movement, and custom exfiltration tools to extract data. This attack follows a recent trend of targeted cyberattacks on retail and apparel sectors, particularly organizations with weak authentication and high-value intellectual property. Security researchers note the group’s preference for high-profile victims with vulnerable infrastructure.

A Kurdish hacker codenamed “MuhmadEmad” from the hacktivist group “KurdLinux_Team” have managed to gain unauthorized access to Dell’s official website subdomains and leave them defaced. The exploit had allowed hackers to inject into the web site's database and get the hashed/encrypted password of admins which would then be cracked to gain access to the website admin control panel, allowing hackers to do anything with the website. Dell investigated the incident and put down the hacked server, the subdomains remain inaccessible.