Smartwatch attack can steal data from air-gapped computers using inaudible signals, new study reveals

A new cyberattack method named SmartAttack has revealed a critical vulnerability in the use of smartwatches inside secure zones. Published on 10 June 2025 by Dr Mordechai Guri of Ben-Gurion University, the research demonstrates how malware on an air-gapped computer can transmit sensitive data ultrasonically to a nearby smartwatch without any visible indication of compromise.

Using inaudible frequencies between 18 and 22 kilohertz, the compromised computer encodes data which is then received by the smartwatch's built-in microphone. The smartwatch forwards the decoded information over Wi-Fi or Bluetooth, bypassing traditional security controls.

Smartphones are often banned in secure areas, but smartwatches typically remain on users' wrists and are less tightly regulated in many cases. Their constant presence on the wrist and directional microphone characteristics make them uniquely suited to this covert role.

Experiments confirm successful data transfer at distances over six metres, with bitrates up to fifty bits per second. This poses serious implications for high-security facilities relying on physical isolation.

While the attack requires both system compromise and proximity, the potential consequences are severe. As cybersecurity journalist Davey Winder notes in Forbes, "just because something is unlikely to occur does not mean it will not or cannot." He adds that any compromised smartwatch "could perform the same trick" to exfiltrate data from even the most sensitive air-gapped systems.

While real-world implementation remains complex, the study underscores a need for increased scrutiny of wearable devices in secure spaces.