A team from the Hong Kong University of Science and Technology (Guangzhou) and Hong Kong Polytechnic University has demonstrated a new eavesdropping technique that turns ordinary consumer electronics into unintentional radio transmitters, using nothing but an external RF signal and the target device's own circuitry.
The attack, detailed in a paper accepted to USENIX Security 2026 and posted to arXiv, exploits a basic property of everyday electronics: audio and other low-frequency signals inside a device are too low in frequency for the device's internal wiring to radiate efficiently, so they normally stay contained. The researchers found that beaming an external RF carrier at the device solves that problem for an attacker. Once picked up by the same wiring, the carrier reaches a nonlinear component, such as an amplifier, ADC, MOSFET driver, or power converter, where its curved input-output response causes it to mix with the original secret signal rather than simply pass it through unchanged. That mixing embeds the audio onto the injected carrier, and because the resulting signal now sits at the carrier's higher frequency, the same wiring radiates it efficiently enough to be picked up at a distance.
Named InjectEave, the technique was tested against 11 commercial devices, including wired and wireless headphones, a landline phone, smart fans, and smart lamps. Audio eavesdropping worked at ranges up to 6 meters with off-the-shelf equipment, extending to 30 meters with an external power amplifier, and functioned through concrete, glass, and wood barriers. In one case study, the team also demonstrated a closed-loop attack that eavesdropped on a landline call and injected synthesized audio back into the conversation.
The researchers note the attack requires prior knowledge of the target device model to identify its effective injection frequency, and they withheld specific vulnerable frequencies from publication pending manufacturer response. Their tests suggest twisted-pair wiring offers meaningful, though not complete, resistance, reducing leakage by roughly 10 dB compared to standard parallel wiring.
