Researchers find way to listen in on headphones from afar

Researchers unveiled InjectEave, an electromagnetic injection side-channel attack that recovers audio from headphones and landline phones up to 30 meters away through walls.

Researchers from HKUST and The Hong Kong Polytechnic University presented InjectEave at USENIX Security 2026, an active EM side-channel attack that injects 0-9 MHz RF signals into nonlinear components such as amplifiers, ADCs, and power converters to modulate and leak target audio. Tested on 11 off-the-shelf devices including Sony, HP, Philips, Apple, and Xiaomi products, the attack recovered intelligible headphone audio from up to 30 meters with an RF amplifier, generally 1-6 meters otherwise, including through walls. The attack uses commodity gear such as a USRP B210 SDR and a Siglent spectrum analyzer, is immune to digital defenses like encryption, and is only partially mitigated by shielding, twisted-pair wiring, and filtering.