A new threat called InjectEave has been disclosed, enabling attackers to recover the audio output from wired or wireless headphones from up to 30 meters away—even through walls—using ordinary radio-frequency (RF) gear. Developed by researchers at Hong Kong-based institutions, it was formally presented in a USENIX Security 2026 paper titled “Injected and Leaked: Actively Inducing Side-Channel Leakage Using Electromagnetic Injection and Hardware Nonlinearity.”
How the InjectEave Attack Works
Traditional electromagnetic (EM) side-channel attacks passively sense stray signals emitted by electronics. InjectEave flips that model. Attackers actively transmit a tuned RF carrier into a target device. Once inside, the signal interacts with nonlinear components—things like audio amplifiers, analog-to-digital converters (ADCs), power converters, and MOSFETs—that are common in headphones and other consumer tech. These components mix the injected signal with legitimate analog outputs, allowing secret audio to hitch a ride on RF emissions that travel much farther than previously possible.
This “Injection-Modulation-Emission” model lets attackers pick an optimal RF frequency for each device, significantly boosting range. With ordinary off-the-shelf gear like software-defined radios (SDRs), antennas, and a ~$415 external RF amplifier, researchers were able to eavesdrop from 30 meters away on specific headphones, including models from UGreen and Philips. Wood and glass barriers caused little signal drop; even concrete walls only reduced leaked audio strength by around 5.8 decibels, yet intelligible speech still came through.
What Devices Are at Risk & What Tests Reveal
The research team tested 11 commercial devices: wired headphones from Sony, Dell, Apple; wireless models from UGreen, Philips, HP; a VoIP landline phone; and smart home gear like lamps and fans. At close range (50 cm), they achieved near-perfect recognition across the board, with signal-to-noise ratios (SNRs) ranging from about 6 dB (for certain earbuds) up to over 23 dB (for some wireless sets).
With the external amplifier in place, the eavesdropping range jumped dramatically—especially for wireless units where speech remained intelligible from 30 meters away. The attack was resilient: usual building materials like wood and glass had minimal effect; even solid concrete walls didn’t block the attack entirely. For non-headphone smart devices, attackers could infer appliance usage, sleep habits, and general occupancy without ever touching the network.
Deepfake Twist & Mitigations
A particularly unsettling variant called “Eavesdrop-Synthesize-Inject” was demonstrated on a Flyingvoice landline phone. In real time, an attacker could open eavesdrop, clone a user’s voice using AI tools, then inject synthetic audio into the headset—triggered by keywords like “confirmation” or “quote.” The injected audio was judged nearly indistinguishable from the real voice, with only minor measured differences in intelligibility metrics.
To clean up noisy, distorted leaked signals, the researchers built a signal-enhancement module based on diffusion-type speech denoising models. These raised SNR from about 7.0 dB to 16.1 dB, and lifted intelligibility from 0.58 to 0.72 in their testing metrics.
Why Standard Defenses Don’t Cut It & What To Do
Existing protections—cryptographic measures, EM shielding—were not effective against InjectEave, since the threat targets continuous analog signals rather than discrete digital processes. Boosting the transmitter power alone helped attackers defeat many shielding efforts.
The researchers noted wiring layout matters: using twisted-pair cables instead of standard parallel wiring reduced leakage by up to ~20 dB, offering a plausible hardware mitigation. Still, fully closing this attack surface will require a combination of hardware and software design—security must be baked into the analog domain as well as the digital.
InjectEave unveils a powerful new analog attack, one that challenges assumptions about physical security layers and signal containment. Any device with audio hardware—headphones, phones, smart appliances—is now part of a broader risk landscape. Moving forward, device designers must rethink analog non-linearities, wiring topologies, and RF exposure. We’ll also need industry standards to catch up, defining how to test, measure, and certify resistance to such active electromagnetic threats.
