EN PT-BR
← Voltar ao feed
high gaming

NIKKE PC launcher supply-chain attack: tampered CDN scripts deliver K2F backdoor and crypto-stealing DLL

2 fonte(s) · 2 atualização(ões) · publicado 04/11/2026 13:58 · coletado há 3 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 05/11/2026 22:01; os links antigos trazem para cá.

Fontes: malwarebytes.com ↗ bleepingcomputer.com ↗

The Windows launcher for Goddess of Victory: NIKKE (developed by Shift Up, published by Level Infinite, a Tencent subsidiary) was hit by a supply-chain attack. Independent researcher MotherSphere found malicious code in four JavaScript files on Level Infinite's official CDN (bleepingcomputer.com, malwarebytes.com). The code downloaded a LuaJIT payload, insight.bundle, which installed the K2F remote-access backdoor. K2F could steal NIKKE credentials and browser data, and could also deploy platform_experience_helper.dll, which targets wallet extensions such as MetaMask, Phantom and Coinbase Wallet. Level Infinite pushed a client update on November 4 (02:30 UTC+9) and replaced the abnormal files. The latest report (malwarebytes.com, November 5) says all four files were clean on the four CDN servers MotherSphere checked, and that Level Infinite added a malware-checking feature to the PC client. The number of compromised PCs and the full extent of data theft remain unclear, and actual cryptocurrency theft has not been confirmed. The game has over 45 million downloads since 2022 (bleepingcomputer.com). Mobile-only players are not affected (malwarebytes.com).

Detalhes técnicos

  • Infection chain: The tampered scripts abused the launcher's native functionality to fetch and execute insight.bundle, which deployed the K2F agent. Because the legitimate launcher fetched the code, players could be infected simply by opening software they already trusted (malwarebytes.com).
  • Infrastructure: The loader was obfuscated to hide two command-and-control domains, insightjs[.]com and insightjs[.]org, with the second as a fallback. As of November 4, insightjs[.]org was serving a multilingual security warning rather than malware, and it is unclear who controls it (bleepingcomputer.com).
  • K2F capabilities: It could run programs and system commands, browse folders and download files, and capture screenshots. It could also retrieve saved NIKKE login credentials, collect browser passwords and cookies, search for developer credentials and API tokens, and collect wallet-extension data (bleepingcomputer.com, malwarebytes.com).
  • DLL payload: platform_experience_helper.dll was an optional payload. It persisted after the launcher was closed and could intercept wallet recovery phrases and private keys from browser extensions. BleepingComputer analyzed it from a VirusTotal sample.
  • Indicator of compromise: The string k2f_chan ("k2f_chan registered" per malwarebytes.com) in Launcher/intl_service/debug.log inside the NIKKE install directory. It confirms Lua agent execution but not whether the DLL was loaded (bleepingcomputer.com).
  • Fix sequence: Level Infinite replaced three abnormal script files early on November 4, then refreshed the CDN cache for the remaining file later that day (malwarebytes.com).

Remediação

  • Players who opened the Windows launcher during the affected period should close it, scan the PC with updated antivirus software, and follow the removal instructions published by NIKKE (malwarebytes.com, bleepingcomputer.com).
  • Secure accounts and change passwords from a clean, unaffected device, not from a possibly compromised PC (both sources).
  • Confirmed compromised users are advised to reinstall Windows entirely (bleepingcomputer.com).
  • Anyone whose cryptocurrency wallet or recovery phrase may have been exposed should treat it as compromised (malwarebytes.com; the source text is truncated at this point).
  • Check debug.log for k2f_chan, keeping in mind that it does not show whether the DLL was loaded.

Relatos divergentes

  • Start of the compromise: bleepingcomputer.com says the CDN files were tampered with as early as September 27, 2026. malwarebytes.com (more recent) reports that Level Infinite says malicious distribution began on October 30, while MotherSphere reports evidence of the agent running as early as October 23. malwarebytes.com also notes that some reporting places the original tampering on September 27. The dates are unreconciled, and the vendor's date is the latest.
  • Cleanup status: bleepingcomputer.com (November 4) reported that one of the four files was reportedly still served as of 22:26 GMT after the update. malwarebytes.com (November 5, more recent) says Level Infinite refreshed the CDN cache for the last file and MotherSphere found all four files clean on the four servers checked. The later report is more current, but it covers only the servers checked.

Linha do tempo

  1. malwarebytes.com ↗ · pub. 05/11/2026 19:06 · coletado 05/11 20:01

    Supply-Chain Compromise of NIKKE PC Launcher Delivered Remote-Access Malware Stealing Credentials and Crypto Wallets

    ler a análise desta fonte

    Players of Goddess of Victory: NIKKE are being urged to scan their PCs after attackers tampered with JavaScript files used by the game's Windows launcher, distributed by Level Infinite (a Tencent subsidiary, with the game developed by Shift Up, per bleepingcomputer.com). The incident is a supply-chain attack: instead of tricking players into downloading a fake game or add-on, attackers compromised resources used by the legitimate launcher, so players could be infected simply by opening software they already trusted. Independent researcher MotherSphere identified the malicious code in four JavaScript files hosted on Level Infinite's official content delivery network (CDN). Level Infinite has released fixes and added a malware-checking feature to the official PC client, but fixing the delivery mechanism does not undo an infection or recover stolen passwords and data. The number of compromised PCs and the full extent of any data theft remain unclear, and mobile-only players are not affected.

    Technical Details

    According to MotherSphere's GitHub analysis, the tampered scripts abused the launcher's native functionality to retrieve and execute a malicious LuaJIT payload named insight.bundle, which installed a remote-access agent referred to as K2F; infected machines log the string "k2f_chan registered" in the launcher's debug.log file (bleepingcomputer.com). The malicious code was served from attacker-controlled domains insightjs[.]com and insightjs[.]org (daily.dev), and a follow-up DLL named platform_experience_helper.dll could steal data from the MetaMask, Phantom and Coinbase Wallet browser extensions (daily.dev). The distributed remote-control agent supported commands to run programs and system commands, browse folders and download files, retrieve saved NIKKE login credentials, collect browser passwords and cookies, search for developer credentials and API tokens, and collect cryptocurrency wallet-extension data. Published timelines diverge: Level Infinite says malicious-program distribution began on October 30, while MotherSphere reports evidence of the remote-control agent running as early as October 23; some reporting citing the same researcher's analysis places the original tampering of the CDN files as far back as September 27 (invenglobal.com, bleepingcomputer.com).

    Fix Details

    Level Infinite replaced three abnormal script files early on November 4, then refreshed the CDN's cache for the remaining file later that day. MotherSphere subsequently reported that all four files were clean on the four CDN servers checked.

    Remediation

    Players who opened the Windows launcher during the affected period should close the launcher, check their PC, and follow the removal instructions published by NIKKE. Accounts should be secured from a clean device, since passwords should not be changed on a computer that may still be compromised. If a cryptocurrency wallet or its recovery phrase may have been exposed, funds should be moved from a clean device to a newly created wallet with a new recovery phrase. Level Infinite asks affected players, including those with financial losses, to contact its customer support team.

    Conflicting Reports

    Level Infinite states malicious-program distribution began on October 30, but MotherSphere's analysis found evidence the remote-control agent was running as early as October 23, and separate reporting attributes the original CDN file tampering to September 27 (invenglobal.com, bleepingcomputer.com).

  2. bleepingcomputer.com ↗ · pub. 04/11/2026 13:58 · coletado 04/11 14:00 primeiro registro

    NIKKE Game Launcher Supply-Chain Attack Distributes K2F Backdoor and Crypto-Stealing DLL

    ler a análise desta fonte

    The PC launcher for Goddess of Victory: NIKKE, developed by Shift Up and published by Level Infinite, was compromised in a supply-chain attack that distributed credential- and cryptocurrency-stealing malware to players. Four JavaScript files hosted on Level Infinite's official CDN were tampered with as early as September 27, 2026, injecting obfuscated code that downloaded a malicious LuaJIT payload named insight.bundle, installing a remote-access backdoor called K2F. The backdoor allowed attackers to execute commands, browse and download files, capture screenshots, steal NIKKE account credentials, and harvest browser-stored information, and could also deploy a malicious DLL (platform_experience_helper.dll) that persisted after the launcher was closed and targeted cryptocurrency wallet browser extensions such as MetaMask, Phantom, and Coinbase Wallet. Level Infinite issued a client update on November 4 at 02:30 (UTC+9) but, per independent researcher MotherSphere, one of the four tampered files was reportedly still being served as of 22:26 GMT. The game has over 45 million downloads since its 2022 launch, making this a potentially wide-reaching incident, though actual cryptocurrency theft has not been confirmed.

    Technical Details

    The injected loader code was hidden inside legitimate JavaScript files and obfuscated to conceal two command-and-control domains, insightjs[.]com and insightjs[.]org, with the second acting as a fallback. The malicious code abused the launcher's native functionality to fetch and execute the LuaJIT payload insight.bundle, deploying the K2F remote-access agent. An optional command could install platform_experience_helper.dll, a Windows DLL analyzed by BleepingComputer from a VirusTotal sample, which contained functionality to intercept cryptocurrency wallet recovery phrases and private keys from browser extensions. A known indicator of compromise is the string k2f_chan logged in Launcher/intl_service/debug.log within the NIKKE installation directory, which confirms Lua agent execution but not whether the DLL payload was loaded. As of publication, the insightjs[.]org domain was serving a multilingual security warning rather than malware, though it is unclear who currently controls it.

    Remediation

    Potentially affected players should run a full system scan with updated antivirus software. Users confirmed to be compromised are advised to reinstall Windows entirely and change all passwords and sensitive credentials from a clean, unaffected device.