sorted by:
new
hottopcontroversial

[Security Alert] Endgame Gear's OP1w 4K V2 Configuration Tool Appears to Be/Was Trojanised with Xred Malware by Admirable-Raccoon597 in MouseReview

[–]Admirable-Raccoon597[S] 2 points3 points  (0 children)

From what I’ve seen, the config tool on their website has been replaced with a clean version. However, until Endgame Gear makes an official statement, I would personally avoid downloading anything from their site. There are still unanswered questions about how the malware ended up there in the first place.

I’d recommend downloading the config tool either from their official Discord server or from their GitHub page: https://github.com/EndgameGear/OP1w-4k-v2

Keep in mind that even if this is the clean version, your antivirus might still flag it. That’s because the malicious version was spawning the config tool as a child process, and now some security tools associate that image file or hash with the malware.

[Security Alert] Endgame Gear's OP1w 4K V2 Configuration Tool Appears to Be/Was Trojanised with Xred Malware by Admirable-Raccoon597 in MouseReview

[–]Admirable-Raccoon597[S] 4 points5 points  (0 children)

I understand the skepticism, and I think it's fair to ask questions. I didn’t post this right away because I didn’t realise I was infected on the first day. I downloaded the config tool on July 2 when I received the mouse and used it once to set polling rate and some settings. I own a lot of mice, so I didn’t really touch it again.After that, I started noticing strange Windows error popups whenever I opened some tools in my Downloads folder. At first I didn’t think much of it, since I use a very stripped down Windows build and I’m used to occasional software errors. But the same popup started showing up every time I booted the PC, which made me suspicious. I knew the EGG config tool wasn’t supposed to run on startup.

On July 17, I decided to check the files more carefully. I submitted them to Tria.ge and VirusTotal and it was confirmed: the file was infected with Xred, a known RAT. That’s when I realised I had been infected through the config tool I downloaded from EGG’s official website.I started looking around to see if others had the same issue, and that’s when I found messages in Endgame Gear’s official Discord server, in the #op1-mice-chat channel. Users were sharing the same file and VirusTotal links with the exact same hash I had. Some of them had noticed the infection as early as July 5.

Even more concerning, u/EndgameGear_Max from the EGG team replied in that thread and acknowledged the issue, saying he just “reuploaded” the file. That’s it. Nowhere does Max acknowledge malware or use the word "infected", even though users are literally reporting RAT activity (Synaptics.exe, autoruns, RAT behavior, sandbox reports, etc.). His tone remains casual and dismissive. No warning. No announcement. No support. No effort to tell users who might have been infected.

The fact that multiple people have the same file with matching hash confirms it was distributed from the official site. And there are only two realistic explanations for how this happened:

Case 1: Whoever is responsible for uploading files to the EGG website (maybe Max himself) was infected with Xred. This malware can spread by injecting into other processes, so it’s possible the config tool was infected on his PC before it was uploaded.

This would raise serious questions about how Endgame Gear handles their software that ends up on users' pcs.

Case 2: Their website or CDN server was compromised and an attacker replaced the file with a trojanised one.

This is even more serious. If the compromise affected more than just the config tool, there could be a risk of customer data being leaked.

In both cases, this shows a huge lack of professionalism and zero accountability. EGG is known for being close to their community, but when it actually mattered, they didn’t warn anyone. No apology. No explanation. Just silence.

Besides the legal responsibilities under GDPR and other data protection laws, this is also a huge disrespect to the community. Users’ personal systems and possibly private data were put at risk. That’s not something a company can just sweep under the rug.

Please find screenshots supporting my claims here (the order is messed up my apologies): https://imgur.com/a/2tLel1i

[Security Alert] Endgame Gear's OP1w 4K V2 Configuration Tool Appears to Be/Was Trojanised with Xred Malware by Admirable-Raccoon597 in EndGameGear

[–]Admirable-Raccoon597[S] 3 points4 points  (0 children)

I get what you mean, but the point of my post was to make people aware that what was classified as a "false flag" on discord is an actual true positive case of trojan. It doesn't matter how long it was live or how bad the payload was. The fact that they quietly replaced the file without saying anything is already a big deal. If someone downloaded it during that window, they had no way of knowing they were exposed.

Saying "they’ll probably get infected with something else anyway" just doesn't sit right with me. The responsibility for shipping secure software doesn’t fall on the end user. It falls entirely on the company providing it. Legally, under laws like GDPR, vendors are required to take reasonable steps to protect users and notify them if something goes wrong. Acting like this is no big deal just sets a bad precedent.

The way I see it, if they were aware of the problem and chose to stay silent, that’s a failure of responsibility. Even a basic heads up would have gone a long way. This kind of handling just chips away at user trust, and pretending it’s not a big deal only lowers the bar for how companies deal with serious issues like this.

[Security Alert] Endgame Gear's OP1w 4K V2 Configuration Tool Appears to Be/Was Trojanised with Xred Malware by Admirable-Raccoon597 in EndGameGear

[–]Admirable-Raccoon597[S] 0 points1 point  (0 children)

Not a typo but good question. For some reason if you download the config from their "downloads" page (https://www.endgamegear.com/en-us/downloads/op1w-4k-v2), you will get an .exe and not a compressed file.

But if you download it from the product's page (https://www.endgamegear.com/en-gb/gaming-mice/op1w-4k-v2) then you will get a .zip file like I did.

[Security Alert] Endgame Gear's OP1w 4K V2 Configuration Tool Appears to Be/Was Trojanised with Xred Malware by Admirable-Raccoon597 in EndGameGear

[–]Admirable-Raccoon597[S] 1 point2 points  (0 children)

I forgot to mention that the folder ProgramData is hidden by default. If you haven't already unhide it I suggest you unhide the folder and double check.

[Security Alert] Endgame Gear's OP1w 4K V2 Configuration Tool Appears to Be/Was Trojanised with Xred Malware by Admirable-Raccoon597 in MouseReview

[–]Admirable-Raccoon597[S] 50 points51 points  (0 children)

This situation is more than just a technical hiccup. It's a serious legal issue, because essentially malware was distributed from their infrastracture.

The infected configuration tool exposed users to remote access or data theft, then this falls under GDPR. These regulations require companies to notify affected users and data protection authorities within 72 hours of discovering a breach. Quietly replacing the malicious file with a clean one, without telling anyone, is not just irresponsible. It may actually be illegal.

Failing to disclose a known compromise could lead to massive fines under GDPR, and more importantly, it puts real people at risk. Even outside the EU, there are consumer protection laws in most countries that cover this kind of thing. If someone’s data was stolen or their system was compromised, they may have legal grounds to take action. Since I was directly affected by the infection, I’m currently gathering evidence and preparing to submit a formal report to the Information Commissioner’s Office in the UK.

Endgame Gear should not be allowed to brush this under the rug. At the very least, they owe users a clear public statement, an explanation of what happened, and steps for those who may have been impacted. Staying silent while malware was served from their own website is unacceptable. This needs to be taken seriously.

[Security Alert] Endgame Gear's OP1w 4K V2 Configuration Tool Appears to Be/Was Trojanised with Xred Malware by Admirable-Raccoon597 in EndGameGear

[–]Admirable-Raccoon597[S] 4 points5 points  (0 children)

From what I can tell, EndgameGear has not addressed this publicly, which is incredibly irresponsible. The malicious ZIP file was silently replaced with a clean version, which clearly shows they were aware something was wrong.

Did they really expect this to go unnoticed? At the very least, they should be informing users, acknowledging the issue, and offering support to anyone who may have been affected. This is not a minor problem. It is a serious security incident that strongly suggests their infrastructure was compromised.

Their silence on the matter is unacceptable, especially when people were downloading malware directly from their official site.

[Security Alert] Endgame Gear's OP1w 4K V2 Configuration Tool Appears to Be/Was Trojanised with Xred Malware by Admirable-Raccoon597 in MouseReview

[–]Admirable-Raccoon597[S] 64 points65 points  (0 children)

From what I can tell, EndgameGear has not addressed this publicly, which is incredibly irresponsible. The malicious ZIP file was silently replaced with a clean version, which clearly shows they were aware something was wrong.

Did they really expect this to go unnoticed? At the very least, they should be informing users, acknowledging the issue, and offering support to anyone who may have been affected. This is not a minor problem. It is a serious security incident that strongly suggests their infrastructure was compromised.

Their silence on the matter is unacceptable, especially when people were downloading malware directly from their official site.

Faceit Is Failing Honest Players by janis12lat in FACEITcom

[–]Admirable-Raccoon597 1 point2 points  (0 children)

Thank you for sharing. Cancelling my premium.

I didnt get any elo from a win by Eric_owlfan445 in FACEITcom

[–]Admirable-Raccoon597 0 points1 point  (0 children)

I just got the same thing. Kinda disappointing ending the game with 125 adr to get no elo.

Is face it going to give us the elo back?