NIKKE PC launcher supply-chain attack pushed a remote-access backdoor and wallet stealer via CDN scripts

What happened

The developers of Goddess of Victory: NIKKE confirmed that the PC launcher’s script files “may have been tampered with by a third party.” They said a client fix and update went out on November 4 at about 02:30 (UTC+9), and that the scope of impact was still under investigation (BleepingComputer).

Independent researcher MotherSphere reported that four JavaScript files hosted on Level Infinite’s official content delivery network (CDN) were modified to inject obfuscated code. When a player opened the launcher, that code fetched more code from attacker-controlled domains, insightjs[.]com and insightjs[.]org, falling back to the second if the first was down. BleepingComputer examined two of the modified files and confirmed the obfuscated loader (BleepingComputer).

According to MotherSphere’s analysis, the downloaded code abused native launcher functionality to run a malicious LuaJIT payload called insight.bundle. That payload installed a remote-access agent referred to as K2F. Reported capabilities (BleepingComputer, Malwarebytes):

• Run programs and system commands.
• Browse folders and download local files.
• Take screenshots.
• Retrieve saved NIKKE login credentials.
• Collect browser passwords and cookies.
• Search for developer credentials, API tokens and other secrets.
• Collect cryptocurrency wallet-extension data.

An additional command could install a Windows DLL named platform_experience_helper.dll that persists after the launcher is closed. BleepingComputer found strings in a VirusTotal DLL sample indicating it can steal wallet data from browser extensions such as MetaMask, Phantom and Coinbase Wallet, including recovery phrases and private keys. It is unknown whether the attackers deployed this DLL on victim machines or actually stole any cryptocurrency (BleepingComputer).

Timeline discrepancies. The sources do not agree on when this began:

• BleepingComputer reports the researcher’s claim that the files were modified on September 27, 2026.
• Malwarebytes says Level Infinite puts the start of malicious distribution at October 30, while MotherSphere reports the remote-control agent running as early as October 23 (Malwarebytes).
• The true start date is not confirmed.

Remediation status. The sources also differ in detail on the cleanup:

• BleepingComputer, citing the researcher, says three files were replaced with clean versions on November 3, and a tampered copy of the fourth was reportedly still served as of 22:26 GMT.
• Malwarebytes says Level Infinite replaced three abnormal script files early on November 4 and refreshed the CDN cache for the remaining file later that day. MotherSphere then reported all four files clean on the four CDN servers checked. Level Infinite also added a malware-checking feature to the official PC client.
• BleepingComputer noted the backup domain insightjs[.]org now serves an unofficial in-launcher warning telling players to close the launcher. Who controls that domain is unclear.
• BleepingComputer’s 5/11 update says NIKKE released instructions for checking computers for compromise (contents not confirmed in the sources provided).

The number of compromised PCs and the full extent of data theft remain unclear (Malwarebytes). No CVE is associated with this incident in the sources.

Am I affected?

• Windows PC players who opened the NIKKE launcher during the exposure window may be affected. The window’s start is not confirmed (September 27, October 23 and October 30 are all cited) and it ended with the November 3 to 4 fixes.
• Mobile-only players are not affected, according to Level Infinite as reported by Malwarebytes.
• Indicator of compromise: the string k2f_chan in Launcher/intl_service/debug.log inside the NIKKE installation directory means the malicious Lua agent executed. It does not show whether the DLL was also loaded (BleepingComputer).
• Network indicators: the domains insightjs[.]com and insightjs[.]org. Check proxy or DNS logs if you manage affected machines.
• File indicator: the presence of platform_experience_helper.dll.
• MotherSphere’s report includes user-reported Malwarebytes detections tied to this attack (Malwarebytes).

What to do now

1. Close the NIKKE launcher and do not open the PC client until you have updated to the fixed client and checked your system.
2. Look for k2f_chan in Launcher/intl_service/debug.log and for platform_experience_helper.dll. Block insightjs[.]com and insightjs[.]org at your DNS or proxy.
3. Follow the check and removal instructions published by NIKKE, and use the malware-checking feature in the updated official client.
4. Run a full scan with updated antivirus software. If you are confirmed compromised, BleepingComputer recommends reinstalling Windows (BleepingComputer).
5. From a clean device only, change passwords and other sensitive credentials. This covers NIKKE, browser-saved logins, and any developer credentials, API tokens or secrets stored on that PC. Treat active browser sessions and cookies as exposed.
6. If a crypto wallet or recovery phrase may have been exposed, use a clean device to move funds to a newly created wallet with a new recovery phrase (Malwarebytes).
7. If you suffered problems with external accounts or financial loss, contact Level Infinite customer support and keep relevant records without handing over personal information.

Sources

• BleepingComputer: NIKKE PC game launcher hacked to spread remote access, data-stealing malware
• Malwarebytes: NIKKE PC launcher compromise put players’ passwords and personal files at risk