According to the latest update, attackers were able to inject malware onto several devices via a tampered driver—one that was hosted on an official Geekom support page, which, according to the publisher, had already been taken offline. A few days ago, Tom’s Infrastructure and Videocardz reported on a Geekom incident affecting several of the manufacturer’s mini PCs.
The report highlights that the attackers exploited this to insert a backdoor into the driver package, enabling them to install malware on Geekom mini PCs. Geekom confirmed the incident and explained that, although the outdated website had been replaced by a fresh one, it could still be found via search engines.
In a fresh development, according to the most recent details, the following models were vulnerable:.
According to the latest update, geekom’s official driver packages on their current site did not include malware. Important: You are only at risk of malware on your Geekom mini PC if you manually searched for a driver for one of these vulnerable models and downloaded it from the outdated Geekom site.
As part of the ongoing story, this incident is problematic because many users are likely to search for fresh driver packages using terms like “[device name] driver patch” and download from the first result that appears on the search page.
Industry observers note that you should act quickly if you were affected. Using this malware, attackers were able to gain extensive permissions on affected Geekom systems, spy on personal data, and steal passwords.
As part of the ongoing story, (If you don’t have one, check out our picks for the best Windows antivirus programs.) You can also use the Windows Device Manager to check when drivers were downloaded and installed for which devices. If you own one of the vulnerable devices, you should arrival your antivirus programs right away and run a thorough malware scan.
In a fresh development, ideally, you’ll have backed up your data beforehand using a backup tool. (Again, if you don’t have one, protect yourself going forward with one of the best Windows backup programs.). If you suspect malware, you should disconnect your PC from the network and factory reset it.
The report highlights that after the reset, you should change all the passwords you used on the affected device. Learn more about how to factory reset a Windows 11 PC.
The report highlights that in this case, although it was an official manufacturer’s website, it was only accessible via a Google search. Instead of searching, it’s always safer to directly visit a manufacturer’s website and navigate to their support pages for drivers. As a general rule: Never install updates or drivers from unknown or untrusted sources.
In a fresh development, this article originally appeared on our sister publication PC-WELT and was translated and localized from German.
The report highlights that after studying communication science, she went straight into a job at PCMagazin and Connect Living. Since then, she has been writing about everything to do with PCs and technology topics, and has been a permanent editor at our German sister site PC-WELT since May 2024. Laura is an enthusiastic gamer as well as a movie and TV fan.