Corsair says bug, not keylogger, behind some K100 keyboards’ creepy behavior

Keylogger-like behavior has some Corsair K100 keyboard customers worried. Several users have reported that their peripherals randomly enter text into their computer that they previously typed days or weeks ago. However, Corsair told Ars Technica that the behavior is a bug, not keylogging, and may be related to the keyboard’s macro recording feature.

A reader alerted us to an ongoing thread on Corsair’s support forum that a user started in August. The user claimed that their K100 started typing on its own while using it with a MacBook Pro, gaming PC and KVM switch.

“Every few days the keyboard would randomly start typing on its own while I’m working on the MacBook. It usually seems to be typing messages I’ve previously typed on the gaming PC and it won’t stop until I unplug and plug the keyboard back it in,” wrote user, “brendenguy.”

Ten users have apparently responded to the thread (we can’t verify the validity of every claim or account, but Corsair has confirmed it’s a known issue), reporting similar experiences.

One said their keyboard started typing a “specific line from a very sensitive email” while interacting with consumer data with their PC in Safe Mode. One user noted that they don’t use Corsair’s iCue software for programming peripherals, but had a similar experience. Another said their K100 typed out over 100 letters against their will, and factory resets and clearing the keyboard’s memory didn’t fix the problem. There are also a few threads on the Linus Tech Tips forum with people claiming the same problem. Some customers said they feared they had been hacked at the time, while a few accused Corsair of stealthy keylogging.

Corsair confirmed to Ars that it had received “several” reports of the K100 behaving this way, but confirmed that “there is no hardware feature on the keyboard that acts as a keylogger.” The company did not immediately respond to follow-up questions about how many keyboards were affected.

“Corsair keyboards do not record user input in any way and do not have the ability to record individual keystrokes,” Corsair’s representative told Ars Technica.

They also insisted that the problem is not widespread, with only a “small number” of complaints out of “tens of thousands” of K100 sales.

The company is investigating what’s causing the problem, but believes it may be related to the keyboard’s ability to record macros. Some, but not all, users have seen the issue resolved with a recent firmware update that Corsair issued, according to Corsair and one person on Corsair’s forum (although they claimed to have different issues after using the update performed).

“The macro function can accidentally turn on and record keyboard and possibly mouse input. These macros are then triggered and input is rendered at a later time and misinterpreted as keylogging. We are still investigating the exact nature of the issue with our customers., ” said Corsair’s spokesperson.

One user on Corsair’s forum said that when their K100 accidentally imported text they typed days ago, the input included the same backspaces and pauses they remembered making when they originally typed the content, which is like a macro function sounds. Corsair’s K100 allows macro recording with or without its own software.

This is not a unique problem either. We found years-old discussions on Reddit that reported similar behavior with Logitech keyboards, and some concluded that accidental macro recording was the culprit.

Still, we don’t blame users for being cautious. After all, we all know how inconspicuous keylogging technology can be. We’ve seen keyloggers sneak into everything from laptop touchpads and audio drivers to corporate laptops and networks and computer accessories, such as keyboards and cables.

Even if there is no malicious activity, any erratic behavior from a peripheral device as advanced and expensive as the K100 is frustrating. Corsair is one of the most famous brands for gaming accessories, and the K100 is one of its most expensive keyboards. With a $200 MSRP, the K100 has some of the most notable features, including the debut of Corsair’s Axon system-on-chip that features an 8,000 Hz polling rate, optical mechanical switches, a bank of macro keys and ‘ enabling a programmable dial. We haven’t seen any reports of similar problems with the Corsair K100 Air or other keyboards from the brand.

Any affected customers should contact Corsair’s support group, Corsair’s representative said. They also said that affected users can reset the K100 by turning off the keyboard and then holding Esc for five seconds while plugging it in.

In response to anyone still concerned about the Corsair keyboard’s security, the company’s spokesperson said: “Corsair takes customer data privacy very seriously, and even if a single user is affected, we will work quickly to resolve the issue to solve.” We’ve asked Corsair if it will offer refunds for the K100 and will update this piece when we hear back.

Corsair’s K100 was released in October 2020 and has a two-year warranty.