Mic-E-Mouse: When Your Gaming Mouse Becomes a Microphone

Researchers at the University of California, Irvine, have demonstrated “Mic-E-Mouse,” a side-channel attack that uses high-DPI optical mouse sensors to sense desk vibrations and reconstruct nearby speech, turning an ordinary input device into a covert listening post. 

With signal processing and machine learning, attackers can then boost intelligibility and achieve notable speech-recognition accuracy.

The attack shows that consumer mice can capture vibration-induced motion at high sampling rates. 

The hidden threat lurking on your desk

High-precision mice (many rated 10k–20k DPI or higher) are ubiquitous in offices and home workspaces and often used with latency-sensitive apps and games that legitimately request frequent pointer updates.

The Mic-E-Mouse attack requires only a way to collect normal mouse packet data — something a benign-looking game or creative app could do — and all heavy lifting (filtering, reconstruction, ML inference) can occur remotely. 

The result is a stealthy eavesdropping vector that bypasses microphones, OS consent dialogs, and many traditional endpoint controls, widening the enterprise attack surface to everyday peripherals.

How researchers turned mouse data into speech

The UC Irvine team collected raw, noisy motion reports from optical sensors while playing back speech; those low-quality traces suffer nonuniform sampling, quantization, and frequency response limitations. 

Their multi-stage pipeline filters noise, compensates for sampling artifacts, and applies machine learning to reconstruct audio, improving signal quality by up to +19 dB and achieving speech-recognition rates meaningful enough for intelligence gathering.

The exploit does not require privileged access to OS audio APIs — only the ability to enumerate and transmit HID/mouse packets.

Any environment using high-fidelity mice alongside software that can capture or forward high-frequency input is potentially vulnerable, including corporate workstations, executive desktops, remote-work setups, and home offices. 

Sensitive conversations near those desks — meetings, credential discussions, or private calls — could be partially reconstructed without microphone access.

Locking down mice before they listen in

Defenders should treat Mic-E-Mouse as a lateral expansion of the data-exfiltration threat model and implement layered controls:

• Reduce data availability: enforce policies that limit pointer polling to reasonable rates for business apps; block or scrutinize software that requests high-frequency HID sampling.
• Control app telemetry & exfiltration: monitor and restrict apps that transmit raw HID/device packets; use network DLP to flag unusual telemetry flows to external endpoints.
• Endpoint hardening: application allow-listing, stricter EDR rules for unexpected games/creative tools on corporate endpoints, and USB device control policies to limit unvetted peripherals.
• Physical & procedural controls: use vibration-damping mouse pads or locate sensitive conversations away from desks with high-DPI mice; consider issuing lower-sensitivity mice for meeting rooms and executives.
• Vendor engagement: pressure peripheral manufacturers to add firmware-level noise/randomization and to document APIs so OSs can mediate high-frequency sampling.

Mic-E-Mouse underscores a broader trend: as sensors grow cheaper and more sensitive, everyday devices can leak surprising channels of information. 

Security programs must expand threat models to include physical-layer telemetry and untrusted software that abuses innocuous device APIs.