I recently bought a heavily discounted Corsair gaming keyboard that had been used as a display sample. Within a few hours of connecting it to my desktop, it began generating keystrokes on its own. At different times, it acted as if Shift were being held, triggered random Alt-Tab switches, and typed phrases into whatever text field happened to be active. It even entered text into browser searches, drive-renaming dialogs, and the password field after a restart.
The behavior continued after changing USB ports, restarting the computer, disabling Wi-Fi, and running a full antivirus scan. I couldn't find any suspicious processes, and I haven't noticed any account activity. The typing was intermittent rather than constant, but it stopped completely when I unplugged the new keyboard and reconnected my old one.
Could this be caused by stored keyboard macros, faulty hardware, or some kind of malware? What should I check, and is it safe to use this keyboard again?
2 Answers
This sounds much more like a defective or deliberately configured keyboard than someone remotely controlling the computer. Malware would not normally be limited to random typing that disappears the moment one particular USB device is removed, especially after the computer is offline. Uninstall the keyboard's configuration software, reset the keyboard to factory settings if that option exists, and avoid entering passwords while it is connected.
The most likely explanation is that the keyboard has onboard macros or corrupted firmware. Some gaming keyboards can store macros internally, and a display or previously owned unit may have been configured to send unusual key sequences. Faulty switches or the keyboard's controller could also produce random input. Test it on a separate computer, preferably without installing its software. If it repeats the behavior there, stop using it and return or replace the keyboard.
That makes sense. I'll test it separately and check whether the keyboard software shows any saved macros.
It could also have been set up as a joke on a display model. Either way, I would treat the keyboard as untrusted and return it rather than rely on it.