NIKKE Game Launcher Supply-Chain Attack Distributes K2F Backdoor and Crypto-Stealing DLL
The PC launcher for Goddess of Victory: NIKKE, developed by Shift Up and published by Level Infinite, was compromised in a supply-chain attack that distributed credential- and cryptocurrency-stealing malware to players. Four JavaScript files hosted on Level Infinite's official CDN were tampered with as early as September 27, 2026, injecting obfuscated code that downloaded a malicious LuaJIT payload named insight.bundle, installing a remote-access backdoor called K2F. The backdoor allowed attackers to execute commands, browse and download files, capture screenshots, steal NIKKE account credentials, and harvest browser-stored information, and could also deploy a malicious DLL (platform_experience_helper.dll) that persisted after the launcher was closed and targeted cryptocurrency wallet browser extensions such as MetaMask, Phantom, and Coinbase Wallet. Level Infinite issued a client update on November 4 at 02:30 (UTC+9) but, per independent researcher MotherSphere, one of the four tampered files was reportedly still being served as of 22:26 GMT. The game has over 45 million downloads since its 2022 launch, making this a potentially wide-reaching incident, though actual cryptocurrency theft has not been confirmed.
Detalhes técnicos
The injected loader code was hidden inside legitimate JavaScript files and obfuscated to conceal two command-and-control domains, insightjs[.]com and insightjs[.]org, with the second acting as a fallback. The malicious code abused the launcher's native functionality to fetch and execute the LuaJIT payload insight.bundle, deploying the K2F remote-access agent. An optional command could install platform_experience_helper.dll, a Windows DLL analyzed by BleepingComputer from a VirusTotal sample, which contained functionality to intercept cryptocurrency wallet recovery phrases and private keys from browser extensions. A known indicator of compromise is the string k2f_chan logged in Launcher/intl_service/debug.log within the NIKKE installation directory, which confirms Lua agent execution but not whether the DLL payload was loaded. As of publication, the insightjs[.]org domain was serving a multilingual security warning rather than malware, though it is unclear who currently controls it.
Remediação
Potentially affected players should run a full system scan with updated antivirus software. Users confirmed to be compromised are advised to reinstall Windows entirely and change all passwords and sensitive credentials from a clean, unaffected device.
Linha do tempo
-
NIKKE Game Launcher Supply-Chain Attack Distributes K2F Backdoor and Crypto-Stealing DLL
ler a análise desta fonte ocultar
The PC launcher for Goddess of Victory: NIKKE, developed by Shift Up and published by Level Infinite, was compromised in a supply-chain attack that distributed credential- and cryptocurrency-stealing malware to players. Four JavaScript files hosted on Level Infinite's official CDN were tampered with as early as September 27, 2026, injecting obfuscated code that downloaded a malicious LuaJIT payload named insight.bundle, installing a remote-access backdoor called K2F. The backdoor allowed attackers to execute commands, browse and download files, capture screenshots, steal NIKKE account credentials, and harvest browser-stored information, and could also deploy a malicious DLL (platform_experience_helper.dll) that persisted after the launcher was closed and targeted cryptocurrency wallet browser extensions such as MetaMask, Phantom, and Coinbase Wallet. Level Infinite issued a client update on November 4 at 02:30 (UTC+9) but, per independent researcher MotherSphere, one of the four tampered files was reportedly still being served as of 22:26 GMT. The game has over 45 million downloads since its 2022 launch, making this a potentially wide-reaching incident, though actual cryptocurrency theft has not been confirmed.
Technical Details
The injected loader code was hidden inside legitimate JavaScript files and obfuscated to conceal two command-and-control domains, insightjs[.]com and insightjs[.]org, with the second acting as a fallback. The malicious code abused the launcher's native functionality to fetch and execute the LuaJIT payload insight.bundle, deploying the K2F remote-access agent. An optional command could install platform_experience_helper.dll, a Windows DLL analyzed by BleepingComputer from a VirusTotal sample, which contained functionality to intercept cryptocurrency wallet recovery phrases and private keys from browser extensions. A known indicator of compromise is the string
k2f_chanlogged inLauncher/intl_service/debug.logwithin the NIKKE installation directory, which confirms Lua agent execution but not whether the DLL payload was loaded. As of publication, the insightjs[.]org domain was serving a multilingual security warning rather than malware, though it is unclear who currently controls it.Remediation
Potentially affected players should run a full system scan with updated antivirus software. Users confirmed to be compromised are advised to reinstall Windows entirely and change all passwords and sensitive credentials from a clean, unaffected device.