A configuration utility designed for an Endgame Gear gaming mouse was recently found to have been compromised with malware, raising concerns among users and prompting a swift response from the company.
Endgame Gear issued a public alert on Wednesday after a customer flagged suspicious activity related to the configuration tool for the OP1w 4k v2 mouse. The user had downloaded the software directly from Endgame Gear’s official site, only to discover it was laced with Xred—a Windows-based malware known for creating backdoors, stealing user data, and executing further malicious payloads on infected systems.
The malware was active on the product page between June 26 and July 9, according to Endgame Gear. “We have since removed the infected file,” the company stated, emphasizing that “this issue was isolated to the OP1w 4k v2 product page download only.”
While it's still unclear how the malware infiltrated the page, Endgame Gear insists its file servers remain uncompromised and no customer data has been accessed. An internal investigation is ongoing to determine whether this was an isolated incident or part of a broader breach.
The compromised tool came to light when a Reddit user warned others, stating: “This did not come from a sketchy site or a third-party mirror. It came from the official vendor page.” The user noticed odd behavior, such as Windows error messages, after installing the tool—triggering a deeper look into the file’s contents.
“This situation is more than just a technical hiccup. It's a serious legal issue, because essentially malware was distributed from their infrastructure," the user added. “Endgame Gear should not be allowed to brush this under the rug.”
The issue was further highlighted by PC review platform Igor’sLAB, which also reported the malware concerns. In response, Endgame Gear has issued an apology to customers, pledging to strengthen its cybersecurity protocols. “A clean version of the affected file was immediately published as soon as we identified the situation," the company noted.
Endgame Gear also confirmed that other official download sources—such as its main downloads page, GitHub repository, and Discord channel—remained unaffected and continued to host only clean files. Additionally, no other v2 series products or tools have been compromised.
Users who may have downloaded the affected software are urged to remove the infected file immediately. Further instructions are available in the company’s detailed security advisory.