A recent blunder by Endgame Gear reveals why it might be best to opt for gaming peripherals that don't make you download or install any software in order to configure your hardware. Recently, a Reddit user u/Admirable-Raccoon597 discovered that the driver for the Endgame Gear OP1w 4K V2 gaming mouse, which we reviewed in June, was infected with malware. Specifically, it had installed an API commonly used for key logging. The infected configuration tool was seemingly on the site for as long as two weeks—from June 26th to July 9th—so anyone who downloaded the tool between those dates may have unwittingly infected their system.
The malware, which is known as XRed or the Synaptics Worm, reportedly created a hidden folder on user PCs, which is how it was found by the Reddit user in the first place. According to Malpedia, XRed "exfiltrates sensitive system information—such as the MAC address, username, and computer name—which is sent via SMTP to hardcoded email addresses. It also incorporates keylogging functionality through keyboard hooking techniques." To its credit, Endgame Gear removed the affected download immediately after being notified by another Redditor via Discord, effectively ensuring that nobody else who downloads the tool should be infected by the same link again. This also confirms that Endgame Gear was as much the victim here, since it was not deliberately infecting users with malware.
Initially, it seemed as though Endgame Gear would try to downplay the severity of the attack by simply replacing the affected download URL on the product page, but the company later issued a statement detailing exactly what went wrong, the measures it has put in place to prevent it happening again, and how users should proceed to make sure their data is safe. According to the announcement, only the configurator on the gaming mouse's product page was infected, so if you downloaded the tool via the main downloads page or the brand's GitHub repository, there should be no concern. Endgame Gear recommends that users verify the authenticity of the configuration tool by inspecting the file: Open the .exe file properties and "navigate to the "Details" tab. Infected files will display "Synaptics Pointing Device Driver" as the "Product name," while clean files will display "Endgame Gear OP1w 4k v2 Configuration Tool". If you find that your computer has been infected by the malware, Endgame Gear recommends that you immediately delete the .exe, enable hidden folders, check for the presence of "C:\ProgramData\Synaptics" and delete it and its contents, and, lastly, run a full virus and malware scan.
The full statement from Endgame Gear reads:
View at TechPowerUp Main Site | Source
The malware, which is known as XRed or the Synaptics Worm, reportedly created a hidden folder on user PCs, which is how it was found by the Reddit user in the first place. According to Malpedia, XRed "exfiltrates sensitive system information—such as the MAC address, username, and computer name—which is sent via SMTP to hardcoded email addresses. It also incorporates keylogging functionality through keyboard hooking techniques." To its credit, Endgame Gear removed the affected download immediately after being notified by another Redditor via Discord, effectively ensuring that nobody else who downloads the tool should be infected by the same link again. This also confirms that Endgame Gear was as much the victim here, since it was not deliberately infecting users with malware.
Initially, it seemed as though Endgame Gear would try to downplay the severity of the attack by simply replacing the affected download URL on the product page, but the company later issued a statement detailing exactly what went wrong, the measures it has put in place to prevent it happening again, and how users should proceed to make sure their data is safe. According to the announcement, only the configurator on the gaming mouse's product page was infected, so if you downloaded the tool via the main downloads page or the brand's GitHub repository, there should be no concern. Endgame Gear recommends that users verify the authenticity of the configuration tool by inspecting the file: Open the .exe file properties and "navigate to the "Details" tab. Infected files will display "Synaptics Pointing Device Driver" as the "Product name," while clean files will display "Endgame Gear OP1w 4k v2 Configuration Tool". If you find that your computer has been infected by the malware, Endgame Gear recommends that you immediately delete the .exe, enable hidden folders, check for the presence of "C:\ProgramData\Synaptics" and delete it and its contents, and, lastly, run a full virus and malware scan.
The full statement from Endgame Gear reads:
View at TechPowerUp Main Site | Source
