Supply-Chain Compromise of NIKKE PC Launcher Delivered Remote-Access Malware Stealing Credentials and Crypto Wallets
Players of Goddess of Victory: NIKKE are being urged to scan their PCs after attackers tampered with JavaScript files used by the game's Windows launcher, distributed by Level Infinite (a Tencent subsidiary, with the game developed by Shift Up, per bleepingcomputer.com). The incident is a supply-chain attack: instead of tricking players into downloading a fake game or add-on, attackers compromised resources used by the legitimate launcher, so players could be infected simply by opening software they already trusted. Independent researcher MotherSphere identified the malicious code in four JavaScript files hosted on Level Infinite's official content delivery network (CDN). Level Infinite has released fixes and added a malware-checking feature to the official PC client, but fixing the delivery mechanism does not undo an infection or recover stolen passwords and data. The number of compromised PCs and the full extent of any data theft remain unclear, and mobile-only players are not affected.
Detalhes técnicos
According to MotherSphere's GitHub analysis, the tampered scripts abused the launcher's native functionality to retrieve and execute a malicious LuaJIT payload named insight.bundle, which installed a remote-access agent referred to as K2F; infected machines log the string "k2f_chan registered" in the launcher's debug.log file (bleepingcomputer.com). The malicious code was served from attacker-controlled domains insightjs[.]com and insightjs[.]org (daily.dev), and a follow-up DLL named platform_experience_helper.dll could steal data from the MetaMask, Phantom and Coinbase Wallet browser extensions (daily.dev). The distributed remote-control agent supported commands to run programs and system commands, browse folders and download files, retrieve saved NIKKE login credentials, collect browser passwords and cookies, search for developer credentials and API tokens, and collect cryptocurrency wallet-extension data. Published timelines diverge: Level Infinite says malicious-program distribution began on October 30, while MotherSphere reports evidence of the remote-control agent running as early as October 23; some reporting citing the same researcher's analysis places the original tampering of the CDN files as far back as September 27 (invenglobal.com, bleepingcomputer.com).
Detalhes da correção
Level Infinite replaced three abnormal script files early on November 4, then refreshed the CDN's cache for the remaining file later that day. MotherSphere subsequently reported that all four files were clean on the four CDN servers checked.
Remediação
Players who opened the Windows launcher during the affected period should close the launcher, check their PC, and follow the removal instructions published by NIKKE. Accounts should be secured from a clean device, since passwords should not be changed on a computer that may still be compromised. If a cryptocurrency wallet or its recovery phrase may have been exposed, funds should be moved from a clean device to a newly created wallet with a new recovery phrase. Level Infinite asks affected players, including those with financial losses, to contact its customer support team.
Relatos divergentes
Level Infinite states malicious-program distribution began on October 30, but MotherSphere's analysis found evidence the remote-control agent was running as early as October 23, and separate reporting attributes the original CDN file tampering to September 27 (invenglobal.com, bleepingcomputer.com).
Linha do tempo
-
Supply-Chain Compromise of NIKKE PC Launcher Delivered Remote-Access Malware Stealing Credentials and Crypto Wallets
ler a análise desta fonte ocultar
Players of Goddess of Victory: NIKKE are being urged to scan their PCs after attackers tampered with JavaScript files used by the game's Windows launcher, distributed by Level Infinite (a Tencent subsidiary, with the game developed by Shift Up, per bleepingcomputer.com). The incident is a supply-chain attack: instead of tricking players into downloading a fake game or add-on, attackers compromised resources used by the legitimate launcher, so players could be infected simply by opening software they already trusted. Independent researcher MotherSphere identified the malicious code in four JavaScript files hosted on Level Infinite's official content delivery network (CDN). Level Infinite has released fixes and added a malware-checking feature to the official PC client, but fixing the delivery mechanism does not undo an infection or recover stolen passwords and data. The number of compromised PCs and the full extent of any data theft remain unclear, and mobile-only players are not affected.
Technical Details
According to MotherSphere's GitHub analysis, the tampered scripts abused the launcher's native functionality to retrieve and execute a malicious LuaJIT payload named insight.bundle, which installed a remote-access agent referred to as K2F; infected machines log the string "k2f_chan registered" in the launcher's
debug.logfile (bleepingcomputer.com). The malicious code was served from attacker-controlled domains insightjs[.]com and insightjs[.]org (daily.dev), and a follow-up DLL named platform_experience_helper.dll could steal data from the MetaMask, Phantom and Coinbase Wallet browser extensions (daily.dev). The distributed remote-control agent supported commands to run programs and system commands, browse folders and download files, retrieve saved NIKKE login credentials, collect browser passwords and cookies, search for developer credentials and API tokens, and collect cryptocurrency wallet-extension data. Published timelines diverge: Level Infinite says malicious-program distribution began on October 30, while MotherSphere reports evidence of the remote-control agent running as early as October 23; some reporting citing the same researcher's analysis places the original tampering of the CDN files as far back as September 27 (invenglobal.com, bleepingcomputer.com).Fix Details
Level Infinite replaced three abnormal script files early on November 4, then refreshed the CDN's cache for the remaining file later that day. MotherSphere subsequently reported that all four files were clean on the four CDN servers checked.
Remediation
Players who opened the Windows launcher during the affected period should close the launcher, check their PC, and follow the removal instructions published by NIKKE. Accounts should be secured from a clean device, since passwords should not be changed on a computer that may still be compromised. If a cryptocurrency wallet or its recovery phrase may have been exposed, funds should be moved from a clean device to a newly created wallet with a new recovery phrase. Level Infinite asks affected players, including those with financial losses, to contact its customer support team.
Conflicting Reports
Level Infinite states malicious-program distribution began on October 30, but MotherSphere's analysis found evidence the remote-control agent was running as early as October 23, and separate reporting attributes the original CDN file tampering to September 27 (invenglobal.com, bleepingcomputer.com).