NIKKE PC Game Launcher CDN Compromise Delivers K2F Remote Access and Data-Stealing Malware

Key facts for NIKKE launcher CDN compromise

Detection coverage for NIKKE launcher CDN compromise

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5252 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: K2F / NIKKE Launcher CDN Compromise — DNS Lookup of insightjs Loader and C2 Domains

Detects any Windows process resolving the K2F loader/C2 domains insightjs.com, analytics.insightjs.com or the fallback insightjs.org (or resolving to the 1984 ehf IPs 89.127.233.127 / 89.126.250.172). The tampered NIKKE launcher CDN scripts (aegis-fix.min.js, images.7fec4c32.js, FeedList.feb647c9.js, vue-bucket.min.js) load https://insightjs.com/l.js and retry the .org TLD on failure, so a lookup is the earliest host-side sign of the supply-chain compromise and precedes download of the insight.bundle LuaJIT agent.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.002, T1583.001, T1071.001, T1008
• Data sources: sysmon, windows_dns_client
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22 earliest=-24h (QueryName="insightjs.com" OR QueryName="*.insightjs.com" OR QueryName="insightjs.org" OR QueryName="*.insightjs.org" OR QueryResults="*89.127.233.127*" OR QueryResults="*89.126.250.172*")
| eval launcher_related=if(match(Image,"(?i)(nikke|launcher|playerinfinite)"),"yes","no")
| stats count min(_time) as first_seen max(_time) as last_seen values(QueryName) as domains values(QueryResults) as resolved values(Image) as processes max(launcher_related) as launcher_related by host, User
| convert ctime(first_seen) ctime(last_seen)
| table host User domains resolved processes launcher_related count first_seen last_seen

Microsoft KQL

DnsEvents
| where TimeGenerated > ago(24h)
| where Name endswith ".insightjs.com" or Name =~ "insightjs.com" or Name endswith ".insightjs.org" or Name =~ "insightjs.org" or IPAddresses has_any ("89.127.233.127", "89.126.250.172")
| summarize Lookups = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Domains = make_set(Name), ResolvedIPs = make_set(IPAddresses) by Computer, ClientIP
| project FirstSeen, LastSeen, Computer, ClientIP, Domains, ResolvedIPs, Lookups

Sigma

title: NIKKE Launcher Supply Chain - DNS Query for K2F insightjs Loader Domains
id: 5b0c7e0a-2f4d-4c1a-9a53-6e1f0d7b2a11
status: experimental
description: Detects DNS resolution of insightjs.com and insightjs.org, the loader and fallback C2 domains injected into the compromised NIKKE PC launcher CDN scripts (K2F agent).
references:
    - https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/
    - https://gist.github.com/MotherSphere/d6c049a09ba8ac3085c51ee9df24a4e5
    - https://github.com/MotherSphere/NIKKE-Launcher-Check
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.resource-development
    - attack.t1583.001
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1008
logsource:
    category: dns_query
    product: windows
detection:
    selection_exact:
        QueryName:
            - 'insightjs.com'
            - 'insightjs.org'
    selection_sub:
        QueryName|endswith:
            - '.insightjs.com'
            - '.insightjs.org'
    condition: 1 of selection_*
falsepositives:
    - Security researchers or analysts deliberately resolving the domains
    - Threat-intel sinkhole or DNS monitoring tooling querying the indicators
level: high

Known false positives:

• Security researchers or sandbox hosts deliberately resolving the indicator domains
• Threat-intel enrichment or DNS sinkhole tooling querying the domains

Tuning notes: Requires Sysmon EventCode 22 (DNS query) logging; adjust index/sourcetype to your Sysmon input. Exclude known analyst or sandbox hosts via a lookup. Any hit on insightjs.com/.org should be treated as high priority; launcher_related=yes raises confidence further. Retro-hunt back to 2026-09-30, the earliest reported loader DNS lookups.

• 🔒 NIKKE Launcher Process Connecting to K2F Loader / C2 Infrastructure · unlock with TL Creds
• 🔒 K2F Malicious [indicator] Written or Loaded from Chrome PlatformExperienceHelper Directory · unlock with TL Creds
• 🔒 NIKKE Launcher Spawning Shells and Discovery Tools (K2F exec / whoami / sysinfo / host_facts) · unlock with TL Creds
• 🔒 Tampered CDN Script Loader Request — insightjs l.js?f= Variants and .org Fallback · unlock with TL Creds
• 🔒 K2F Agent Temporary Artifacts — k2f-bcreds, k2f_screen and k2f-keyscan Files · unlock with TL Creds
• 🔒 K2F Payload Download and Data Upload — [indicator] [indicator] and /px/ Endpoints · unlock with TL Creds
• 🔒 K2F Chrome COM Hijack — CLSID {E77CC89B-7401-4C04-8CED-149DB35ADD04} InprocServer32 Registration · unlock with TL Creds
• 🔒 K2F Agent C2 Check-in Beaconing — ~1800s Interval with 360s Jitter to insightjs Infrastructure · unlock with TL Creds

Indicators of compromise for NIKKE launcher CDN compromise

As of 2026-11-04, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-5252.

Sample indicators (3 of 27)

• IP address: 89.127.233[.]127
• Domain: insightjs[.]com
• URL: hxxps://sg-gpts[.]playerinfinite[.]com/comm/assets/lib/aegis-fix.min.js

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

How NIKKE launcher CDN compromise works

The malware provides remote command execution, file browsing/download, screenshots, credential theft and cryptocurrency wallet data theft. Attribution is unknown.

On 2026-09-27 (06:41-06:42 GMT) four JavaScript files hosted on Level Infinite's CDN (playerinfinite.com, served from Tencent COS) and consumed by the NIKKE PC launcher were modified: aegis-fix.min.js (sg-gpts.playerinfinite.com), and images.7fec4c32.js, FeedList.feb647c9.js and vue-bucket.min.js (na-webassets.playerinfinite.com). Each received a short injected snippet that hid the loader URL in an integer array decoded at runtime with TextDecoder/Uint8Array/Uint32Array, loaded https://insightjs.com/l.js?f=<aegis|images|feedlist|vue> through a script tag, and retried with the .org TLD (string built via String.fromCharCode) if the .com load failed. The insightjs.com domain was registered 2026-09-27 01:59 GMT, about five hours before the CDN files were changed. How the attacker obtained write access to the CDN is unconfirmed.

The loader script used the launcher's built-in download function (tinyget) to fetch insight.bundle (205,135 bytes) from analytics.insightjs.com/comm/assets/insight.bundle. The payload is stripped 32-bit LuaJIT 2.0 bytecode obfuscated with Prometheus, with build name K2F_LUA_BUILD. The agent talks to the launcher over a bridge channel named k2f_chan (JSON messages of the form {op:'open', cmd:'<name>', arg:{...}}), checks in about every 1800 seconds with 360 seconds of jitter, and exposes 19 commands: exec, ls, cd, cat, download, file_chunk, screens, creds, browserscan, chrome_scan, keyscan, wallet_files, whoami, sysinfo, host_facts, chrome_install, chrome_cleanup, chrome_uninstall and payload_cleanup. It stores state under the key k2f.agent.state in the launcher's Local Storage LevelDB and writes temporary files (k2f-bcreds-*.db, k2f_screen_*.jpg, k2f-keyscan-*.db in the Oct 23 build) that are deleted after use.

On Windows the agent can install platform_experience_helper.dll (250,368 bytes) into %LOCALAPPDATA%\Google\Chrome\User Data\PlatformExperienceHelper\<64-hex>\ and register it under HKCU\Software\Classes\CLSID\{E77CC89B-7401-4C04-8CED-149DB35ADD04}\InprocServer32 so Chrome loads it via COM, which persists after the launcher is closed and does not require Chrome to be installed. The DLL reads passwords typed into web pages and wallet recovery phrases and uploads to https://analytics.insightjs.com/px/<32-hex agent id>. Targeted data includes saved passwords and cookies from Chrome, Edge, Brave, Vivaldi, Opera and Firefox, Windows Credential Manager, 28 browser-extension crypto wallets (MetaMask, Phantom, Coinbase Wallet, Binance, OKX, Bybit, Bitget, Trust, Rabby, Rainbow, Keplr, Solflare, Backpack, Tonkeeper, TronLink, Xverse, UniSat, Petra, Ronin, Magic Eden and others), NIKKE launcher data in %APPDATA%\nikke_launcher and nikke_launcher_hmt, and about 264 file paths holding developer and cloud secrets (SSH and GPG keys, AWS, Google Cloud, Azure, GitHub, Docker, Kubernetes, npm, Terraform). Linux (Proton/Steam Deck) and macOS users running the launcher are also covered by the independent checker tool.

Infrastructure: insightjs.com resolved to 89.126.250.172 until about Oct 21 and then to 89.127.233.127, both on 1984 ehf (Iceland, AS44925). The earliest reported loader DNS lookups were Sep 30 and the first agent start reported was Oct 23 16:40 GMT. FeedList was cleaned at origin on Oct 28 but cached copies kept being served from CDN nodes (43.175.144.148, 43.175.145.181). On Nov 3 17:04-17:23 GMT Level Infinite replaced the remaining three files; the C2 stopped responding at 18:31 GMT, and the fallback domain insightjs.org was registered by a third party at 17:55 GMT that day. The last CDN servers were updated to clean copies by 03:21 GMT Nov 4. Level Infinite stated that the launcher's script files may have been tampered with by a third party and issued a client update around 02:30 UTC+9 on Nov 4. The game has 45+ million reported downloads. Independent researcher MotherSphere published the primary technical analysis and a read-only checker; attribution is unknown and the investigation is ongoing. BeaconBeagle lookups for the C2 IP and domain returned HTTP 502 during this research and could not be used for correlation.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture

Command and Control

T1008 Fallback Channels; T1071.001 Web Protocols

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 File Deletion

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery; T1217 Browser Information Discovery

Execution

T1059.007 JavaScript; T1059.011 Lua

Initial Access

T1195.002 Compromise Software Supply Chain

Persistence

T1546.015 Component Object Model Hijacking

Credential Access

T1552.001 Credentials In Files; T1552.004 Private Keys; T1555.003 Credentials from Web Browsers; T1555.004 Windows Credential Manager

Resource Development

T1583.001 Domains

Impact

T1657 Financial Theft

Remediation for NIKKE launcher CDN compromise

Patches

• Install the NIKKE launcher client update released 2026-11-04 and clear %APPDATA%\nikke_launcher\tbs_cache before relaunching

Immediate actions

• Block insightjs.com, analytics.insightjs.com, insightjs.org and 89.127.233.127 (also 89.126.250.172) at DNS, firewall or hosts file
• Search Launcher/intl_service/debug.log for 'k2f_chan registered' and the launcher LevelDB (%APPDATA%\nikke_launcher\tbs_cache\Local Storage\leveldb) for 'k2f.agent'
• Hunt for the registry key HKCU\Software\Classes\CLSID\{E77CC89B-7401-4C04-8CED-149DB35ADD04} and platform_experience_helper.dll under Chrome's PlatformExperienceHelper directory
• If infected: disconnect, delete the CLSID registry key, reboot, delete the malicious DLL, then rotate all passwords, API tokens and SSH keys and move crypto funds with new seed phrases

Workarounds

• Do not run the NIKKE PC launcher until Level Infinite confirms resolution
• Use the read-only MotherSphere NIKKE-Launcher-Check tool to look for traces

Longer-term hardening

• Consider a clean Windows reinstall for confirmed infections
• Enable 2FA and use hardware wallets for cryptocurrency holdings
• Do not store developer or cloud credentials on gaming machines
• Alert on newly created per-user COM InprocServer32 registrations pointing into browser profile directories

Affected and fixed versions

• Level Infinite / Shift Up — Goddess of Victory: NIKKE PC Launcher
  Vulnerable versions: Launchers that loaded the tampered CDN scripts between 2026-09-27 and 2026-11-04
  Fixed in: Client update released 2026-11-04 and clean CDN files restored 2026-11-03/04

Timeline of NIKKE launcher CDN compromise

• 2026-09-27 Four Level Infinite CDN JavaScript files (aegis-fix.min.js, images.7fec4c32.js, FeedList.feb647c9.js, vue-bucket.min.js) modified at 06:41-06:42 GMT to load https://locked-ioc-25/l.js
• 2026-09-27 locked-ioc-25 registered at 01:59 GMT, about five hours before the CDN files were modified
• 2026-09-30 Earliest reported DNS lookups of the loader domain; a modified FeedList copy was cached the same day
• 2026-10-23 First locked-ioc-27 agent start reported at 16:40 GMT; an Oct 23 build of the Lua payload (locked-ioc-27.lua, 165,108 bytes) is documented
• 2026-10-28 FeedList.feb647c9.js cleaned at origin at 15:46 GMT, but cached modified copies continued to be served by CDN nodes; three other files stayed compromised
• 2026-11-03 Level Infinite replaced the remaining three files at 17:04-17:23 GMT; locked-ioc-26 registered by a third party at 17:55 GMT; primary C2 stopped responding at 18:31 GMT
• 2026-11-03 First public warning in the NIKKE Discord community at 16:11 GMT; locked-ioc-24 rebuilt at 16:22 GMT
• 2026-11-04 BleepingComputer reports the compromise based on independent researcher MotherSphere's analysis; attribution remains unknown
• 2026-11-04 Last CDN servers updated to clean copies by 03:21 GMT; Level Infinite stated script files may have been tampered with by a third party and shipped a client update around 02:30 UTC+9

Sources cited for NIKKE launcher CDN compromise

• NIKKE PC launcher compromise (Nov 2026): Level Infinite CDN files modified, remote-control agent, indicators (MotherSphere gist) GitHub · Research
• VirusTotal sample 4bfaf98a... referenced by BleepingComputer virustotal.com · Research
• NIKKE-Launcher-Check incident documentation (MotherSphere) GitHub · Code repository
• NIKKE-Launcher-Check indicator checks (MotherSphere) GitHub · Code repository
• NIKKE-Launcher-Check repository GitHub · Code repository
• NIKKE PC game launcher hacked to spread remote access, data-stealing malware (BleepingComputer) BleepingComputer · News · 2026-11-04
• 'Is My PC Infected?' Nikke Launcher Tampering Concerns: From Attack Vector to Remediation (Inven Global) invenglobal.com · News
• Goddess of Victory: NIKKE PC Launcher Tampered With by Third Party (Siliconera) siliconera.com · News

More in supply chain

• PolinRider Loader Reappears in Hijacked npm Packages (12 malicious releases across 10 packages)
• Malicious cPGuard Updates Served in OpsShield Supply Chain Attack (Update CDN Compromise, cPGuard 5.88.12-5.88.19)
• Supply Chain Attack Artifacts in GitHub Repositories and Developer Machines (Miasma, Shai-Hulud, ForceMemo, Megalodon, GhostAction, TeamPCP and others)
• Binance Wallet Infrastructure Compromise via Fake Job Interviews, Trojanized Homebrew Installer and Internal AI Tool Abuse (~$6.3B Theft, TraderTraitor)
• cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes (OPSSHIELD Supply-Chain Compromise)

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages