A team from the Hong Kong University of Science and Technology in Guangzhou has revealed a novel method to intercept audio from headphones at distances up to 30 meters, exploiting unintended electromagnetic emissions rather than breaking encryption. The technique, named InjectEave, was demonstrated on eleven consumer headphone models from brands including Sony, Apple, HP, and Philips, showing that even encrypted audio streams can be compromised through physical-layer vulnerabilities. The findings were presented in late September 2026, highlighting a growing concern for wireless audio security in everyday devices.
The attack works by capturing radio frequency signals unintentionally emitted by the headphone’s internal amplifiers and wiring when processing audio signals. These emissions, which correlate directly with the sound being played, can be demodulated by a nearby receiver to reconstruct the original audio with high fidelity. Unlike traditional hacking methods that target software or encryption protocols, InjectEave bypasses all digital protections entirely, as it operates at the electromagnetic level. Researchers noted that the effectiveness of the attack varied slightly depending on the headphone’s shielding and cable length, but all tested devices were susceptible to some degree. The equipment required for the attack is relatively inexpensive and accessible, raising concerns about potential misuse in public spaces such as offices, cafes, or transportation hubs.
The study found that over-ear headphones with better electromagnetic shielding tended to leak less signal, making them slightly more resistant to the InjectEave attack compared to in-ear models or those with longer, unshielded cables. Apple’s AirPods Pro and Sony’s WH-1000XM5 showed lower leakage levels, though still detectable within the 30-meter range under optimal conditions. In contrast, certain Philips and HP models exhibited stronger emissions, making them easier targets from greater distances. The researchers emphasized that the vulnerability stems from the fundamental design of analog audio circuits, which must drive speakers with varying currents that inevitably produce detectable electromagnetic fields. They suggested that future designs could mitigate this risk through improved shielding, differential signaling, or active noise cancellation in the electrical domain, though such changes may increase cost and complexity.
While no consumer-facing countermeasures currently exist to fully prevent InjectEave-style eavesdropping, users can reduce risk by opting for wired headphones with shorter cables or those explicitly designed with electromagnetic shielding. Avoiding sensitive conversations in environments where unknown devices might be nearby—such as shared workspaces or public transit—is also advised. The research team has notified the affected manufacturers and hopes their findings will encourage industry-wide standards for electromagnetic emissions in audio devices. They warn that as wireless and wearable tech becomes more pervasive, side-channel attacks like this will likely grow in frequency and sophistication, demanding proactive security considerations at the hardware level.
Can encryption prevent this type of attack? No, because InjectEave exploits electromagnetic leakage from the headphone’s analog components, which occurs before any digital encryption is applied or after it is decrypted for playback, rendering cryptographic protections ineffective.
Which headphones were most vulnerable in the test? Models from Philips and HP showed the highest levels of electromagnetic leakage, making them easier to eavesdrop on from the full 30-meter distance, while shielded models like Apple’s AirPods Pro and Sony’s WH-1000XM5 leaked less but were still susceptible.
Is this attack practical in real-world scenarios? Yes, the equipment needed is low-cost and portable, and the attack works through walls and obstacles, making it feasible in offices, cafes, or public areas where targets may not suspect audio interception via electromagnetic means.