Geekom's support website hosted a malware-laden LAN driver package for its AMD mini PCs (A7, A8, AE7, AE8, AX7 Pro, and AX8 Pro), with the executable (Install_PCIE_Win11_11.10.0720.2022_11222022.exe) flagged by VirusTotal, FileScan, MetaDefender, and ClamAV as the Asruex backdoor malware. VideoCardz confirmed the detection on August 15, 2026; reports of the same compromised file hash trace back to December 2024. Geekom has since removed the affected legacy driver page and apologized, clarifying that the malware was not present in the factory-shipped Windows installations.
The backdoor would grant administrator-level access to attackers, allowing them to steal data, intercept keystrokes, retrieve passwords, and establish remote command-and-control connections. The affected driver was hosted on an outdated legacy support page that was no longer linked through Geekom's normal navigation but remained indexed by search engines and discoverable through Google. Users seeking the latest LAN driver would likely find the compromised version through search, and many who rely on OEM driver archives (rather than component vendors like Realtek) would download it unknowingly.
For operators and architects, this is a supply-chain lesson: OEM driver distribution, especially from smaller Taiwan-based manufacturers, remains a weak point. Geekom asked VideoCardz to retract the report; the outlet declined. Geekom's recommended remediation is to delete the installer, run full security scans, reinstall the driver from Windows Update or Realtek, or wipe and reinstall Windows using Microsoft's official image. This incident mirrors 2024's AceMagic mini-PC compromise (Bladabindi and Redline malware in factory installations) and underscores why treating OEM bundles as untrusted is standard practice.