In February 2018, Mordechai Guri's team at Ben-Gurion University published ODINI: proof-of-concept malware that lifts data off an air-gapped computer sitting inside a Faraday cage. Overload the CPU cores, and the low-frequency magnetic fields you generate pass straight through shielding designed to stop radio. Forty bits per second at 100 to 150 centimetres.
Its companion, MAGNETO, dispensed with the dedicated receiver: an Android app read the phone's own magnetometer at 5 bits per second from 12.5 centimetres, and kept working with the handset in airplane mode or zipped inside a Faraday bag. Enough for passwords, tokens, keystrokes and keys. Not enough for files.
Both papers rested on one assumption — that something had already infected the isolated machine. ESET closed that gap in October 2024, reporting what it called the first confirmed compromise of air-gapped systems: GoldenJackal toolsets at a European government body from May 2022 to March 2024. Infected USB drives carried the malware in, then carried emails, documents and keys out.
The channel research didn't stop either. The same lab has since turned RAM into a radio transmitter with RAMBO and LCD panels into speakers with PIXHELL, and in June 2025 published SmartAttack — ultrasonic signals at 18 to 22 kHz, picked up by a compromised Wear OS smartwatch at up to 50 bits per second over more than six metres.
Defences haven't moved much. Mu-metal shielding works and costs accordingly. Jamming works, with field generators or free in software by injecting random CPU load. Zoning is the one that survives contact with a budget — and it now has to cover watches and phones, not just laptops.
Source: Cybersecurity News · ESET via BleepingComputer · SecurityWeek
