WiFi signals as a motion sensor

ISeeU uses Channel State Information from standard WiFi hardware to detect movement through walls — post-exploitation surveillance without cameras.

Standard WiFi hardware continuously measures how radio signals propagate between transmitter and receiver. This Channel State Information (CSI) data captures amplitude and phase across multiple subcarriers — and it changes measurably when a person moves through the signal path.

ISeeU turns a compromised WiFi access point into a passive motion detector. No cameras, no additional hardware, no new network traffic to flag.

function detectMotion(csiBuffer, threshold) {
    const amplitudes = extractSubcarrierAmplitudes(csiBuffer);
    const variance = computeVariance(amplitudes, baselineAmplitudes);

    if (variance > threshold) {
        return {
            detected: true,
            magnitude: variance,
            timestamp: Date.now(),
            subcarriers: identifyAffectedBands(amplitudes)
        };
    }
    return { detected: false };
}

The attack scenario

After gaining access to a target’s network (via credential theft, evil twin, or exploiting a router vulnerability), the attacker reflashes the AP firmware or deploys a userspace daemon that captures CSI data from the wireless chipset.

The collected data reveals:

Whether someone is present in a room
Approximate movement patterns
Entry/exit events (useful for determining occupancy schedules)

All of this works through standard drywall and most interior walls. The signal degradation actually makes the motion signature more pronounced at the amplitude level.

Detection difficulty

From the target’s perspective, there is no anomalous network traffic. CSI is captured at the physical layer before any packet processing. The only indicators would be unusual firmware modifications on the AP itself or slightly elevated CPU usage.

Source: github.com/ThomasNJordan/ISeeU