# NIKKE PC Game Launcher CDN Compromise Delivers K2F Remote Access and Data-Stealing Malware > Four JavaScript files on Level Infinite's CDN used by the Goddess of Victory: NIKKE PC launcher (Shift Up) were modified on 2026-09-27 to load a script from insightjs.com (fallback insightjs.org), which delivered the K2F LuaJIT remote-access agent (insight.bundle) and a Chrome-loaded DLL (platform_experience_helper.dll). The malware provides remote command execution, file browsing/download, screenshots, credential theft and cryptocurrency wallet data theft. Attribution is unknown. - **Published:** 2026-11-04T17:14:24Z - **Last reviewed:** 2026-11-04T17:14:24Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5252 - **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5252.png - **ID:** TL-2026-5252 - **Severity:** HIGH - **Category:** SUPPLY_CHAIN - **Status:** ACTIVE - **Detections:** 9 (1 shown free below) · **IOCs:** 27 (3 shown free below) ## Description On 2026-09-27 (06:41-06:42 GMT) four JavaScript files hosted on Level Infinite's CDN (playerinfinite.com, served from Tencent COS) and consumed by the NIKKE PC launcher were modified: aegis-fix.min.js (sg-gpts.playerinfinite.com), and images.7fec4c32.js, FeedList.feb647c9.js and vue-bucket.min.js (na-webassets.playerinfinite.com). Each received a short injected snippet that hid the loader URL in an integer array decoded at runtime with TextDecoder/Uint8Array/Uint32Array, loaded https://insightjs.com/l.js?f= through a script tag, and retried with the .org TLD (string built via String.fromCharCode) if the .com load failed. The insightjs.com domain was registered 2026-09-27 01:59 GMT, about five hours before the CDN files were changed. How the attacker obtained write access to the CDN is unconfirmed. The loader script used the launcher's built-in download function (tinyget) to fetch insight.bundle (205,135 bytes) from analytics.insightjs.com/comm/assets/insight.bundle. The payload is stripped 32-bit LuaJIT 2.0 bytecode obfuscated with Prometheus, with build name K2F_LUA_BUILD. The agent talks to the launcher over a bridge channel named k2f_chan (JSON messages of the form {op:'open', cmd:'', arg:{...}}), checks in about every 1800 seconds with 360 seconds of jitter, and exposes 19 commands: exec, ls, cd, cat, download, file_chunk, screens, creds, browserscan, chrome_scan, keyscan, wallet_files, whoami, sysinfo, host_facts, chrome_install, chrome_cleanup, chrome_uninstall and payload_cleanup. It stores state under the key k2f.agent.state in the launcher's Local Storage LevelDB and writes temporary files (k2f-bcreds-*.db, k2f_screen_*.jpg, k2f-keyscan-*.db in the Oct 23 build) that are deleted after use. On Windows the agent can install platform_experience_helper.dll (250,368 bytes) into %LOCALAPPDATA%\Google\Chrome\User Data\PlatformExperienceHelper\<64-hex>\ and register it under HKCU\Software\Classes\CLSID\{E77CC89B-7401-4C04-8CED-149DB35ADD04}\InprocServer32 so Chrome loads it via COM, which persists after the launcher is closed and does not require Chrome to be installed. The DLL reads passwords typed into web pages and wallet recovery phrases and uploads to https://analytics.insightjs.com/px/<32-hex agent id>. Targeted data includes saved passwords and cookies from Chrome, Edge, Brave, Vivaldi, Opera and Firefox, Windows Credential Manager, 28 browser-extension crypto wallets (MetaMask, Phantom, Coinbase Wallet, Binance, OKX, Bybit, Bitget, Trust, Rabby, Rainbow, Keplr, Solflare, Backpack, Tonkeeper, TronLink, Xverse, UniSat, Petra, Ronin, Magic Eden and others), NIKKE launcher data in %APPDATA%\nikke_launcher and nikke_launcher_hmt, and about 264 file paths holding developer and cloud secrets (SSH and GPG keys, AWS, Google Cloud, Azure, GitHub, Docker, Kubernetes, npm, Terraform). Linux (Proton/Steam Deck) and macOS users running the launcher are also covered by the independent checker tool. Infrastructure: insightjs.com resolved to 89.126.250.172 until about Oct 21 and then to 89.127.233.127, both on 1984 ehf (Iceland, AS44925). The earliest reported loader DNS lookups were Sep 30 and the first agent start reported was Oct 23 16:40 GMT. FeedList was cleaned at origin on Oct 28 but cached copies kept being served from CDN nodes (43.175.144.148, 43.175.145.181). On Nov 3 17:04-17:23 GMT Level Infinite replaced the remaining three files; the C2 stopped responding at 18:31 GMT, and the fallback domain insightjs.org was registered by a third party at 17:55 GMT that day. The last CDN servers were updated to clean copies by 03:21 GMT Nov 4. Level Infinite stated that the launcher's script files may have been tampered with by a third party and issued a client update around 02:30 UTC+9 on Nov 4. The game has 45+ million reported downloads. Independent researcher MotherSphere published the primary technical analysis and a read-only checker; attribution is unknown and the investigation is ongoing. BeaconBeagle lookups for the C2 IP and domain returned HTTP 502 during this research and could not be used for correlation. ## MITRE ATT&CK - T1583.001 Domains - T1195.002 Compromise Software Supply Chain - T1059.007 JavaScript - T1059.011 Lua - T1546.015 Component Object Model Hijacking - T1027 Obfuscated Files or Information - T1070.004 File Deletion - T1555.003 Credentials from Web Browsers - T1555.004 Windows Credential Manager - T1552.001 Credentials In Files - T1552.004 Private Keys - T1082 System Information Discovery - T1033 System Owner/User Discovery - T1217 Browser Information Discovery - T1005 Data from Local System - T1113 Screen Capture - T1071.001 Web Protocols - T1008 Fallback Channels - T1657 Financial Theft ## Free detection (Splunk SPL, Microsoft KQL, Sigma) **K2F / NIKKE Launcher CDN Compromise — DNS Lookup of insightjs Loader and C2 Domains** (`TL-2026-5252-SPL-001`) Detects any Windows process resolving the K2F loader/C2 domains insightjs.com, analytics.insightjs.com or the fallback insightjs.org (or resolving to the 1984 ehf IPs 89.127.233.127 / 89.126.250.172). The tampered NIKKE launcher CDN scripts (aegis-fix.min.js, images.7fec4c32.js, FeedList.feb647c9.js, vue-bucket.min.js) load https://insightjs.com/l.js and retry the .org TLD on failure, so a lookup is the earliest host-side sign of the supply-chain compromise and precedes download of the insight.bundle LuaJIT agent. - **Languages:** Splunk SPL, Microsoft KQL, Sigma - **ATT&CK:** T1195.002, T1583.001, T1071.001, T1008 - **Data sources:** sysmon, windows_dns_client - **Severity:** high - **Confidence:** high ### Splunk SPL ```spl index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22 earliest=-24h (QueryName="insightjs.com" OR QueryName="*.insightjs.com" OR QueryName="insightjs.org" OR QueryName="*.insightjs.org" OR QueryResults="*89.127.233.127*" OR QueryResults="*89.126.250.172*") | eval launcher_related=if(match(Image,"(?i)(nikke|launcher|playerinfinite)"),"yes","no") | stats count min(_time) as first_seen max(_time) as last_seen values(QueryName) as domains values(QueryResults) as resolved values(Image) as processes max(launcher_related) as launcher_related by host, User | convert ctime(first_seen) ctime(last_seen) | table host User domains resolved processes launcher_related count first_seen last_seen ``` ### Microsoft KQL ```kql DnsEvents | where TimeGenerated > ago(24h) | where Name endswith ".insightjs.com" or Name =~ "insightjs.com" or Name endswith ".insightjs.org" or Name =~ "insightjs.org" or IPAddresses has_any ("89.127.233.127", "89.126.250.172") | summarize Lookups = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Domains = make_set(Name), ResolvedIPs = make_set(IPAddresses) by Computer, ClientIP | project FirstSeen, LastSeen, Computer, ClientIP, Domains, ResolvedIPs, Lookups ``` ### Sigma ```yaml title: NIKKE Launcher Supply Chain - DNS Query for K2F insightjs Loader Domains id: 5b0c7e0a-2f4d-4c1a-9a53-6e1f0d7b2a11 status: experimental description: Detects DNS resolution of insightjs.com and insightjs.org, the loader and fallback C2 domains injected into the compromised NIKKE PC launcher CDN scripts (K2F agent). references: - https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/ - https://gist.github.com/MotherSphere/d6c049a09ba8ac3085c51ee9df24a4e5 - https://github.com/MotherSphere/NIKKE-Launcher-Check author: AII-Detector — ThreadLinqs Intelligence date: 2026-11-04 tags: - attack.initial-access - attack.t1195.002 - attack.resource-development - attack.t1583.001 - attack.command-and-control - attack.t1071.001 - attack.t1008 logsource: category: dns_query product: windows detection: selection_exact: QueryName: - 'insightjs.com' - 'insightjs.org' selection_sub: QueryName|endswith: - '.insightjs.com' - '.insightjs.org' condition: 1 of selection_* falsepositives: - Security researchers or analysts deliberately resolving the domains - Threat-intel sinkhole or DNS monitoring tooling querying the indicators level: high ``` **Known false positives:** - Security researchers or sandbox hosts deliberately resolving the indicator domains - Threat-intel enrichment or DNS sinkhole tooling querying the domains **Tuning notes:** Requires Sysmon EventCode 22 (DNS query) logging; adjust index/sourcetype to your Sysmon input. Exclude known analyst or sandbox hosts via a lookup. Any hit on insightjs.com/.org should be treated as high priority; launcher_related=yes raises confidence further. Retro-hunt back to 2026-09-30, the earliest reported loader DNS lookups. ### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds - NIKKE Launcher Process Connecting to K2F Loader / C2 Infrastructure (locked: unlock with TL Creds) - K2F Malicious [indicator] Written or Loaded from Chrome PlatformExperienceHelper Directory (locked: unlock with TL Creds) - NIKKE Launcher Spawning Shells and Discovery Tools (K2F exec / whoami / sysinfo / host_facts) (locked: unlock with TL Creds) - Tampered CDN Script Loader Request — insightjs l.js?f= Variants and .org Fallback (locked: unlock with TL Creds) - K2F Agent Temporary Artifacts — k2f-bcreds, k2f_screen and k2f-keyscan Files (locked: unlock with TL Creds) - K2F Payload Download and Data Upload — [indicator] [indicator] and /px/ Endpoints (locked: unlock with TL Creds) - K2F Chrome COM Hijack — CLSID {E77CC89B-7401-4C04-8CED-149DB35ADD04} InprocServer32 Registration (locked: unlock with TL Creds) - K2F Agent C2 Check-in Beaconing — ~1800s Interval with 360s Jitter to insightjs Infrastructure (locked: unlock with TL Creds) Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup ## Sample indicators (3 of 27) Defanged, TLP:CLEAR. - IP address: `89.127.233[.]127` - Domain: `insightjs[.]com` - URL: `hxxps://sg-gpts[.]playerinfinite[.]com/comm/assets/lib/aegis-fix.min.js` Full set of 27 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds ## Sources - [NIKKE PC game launcher hacked to spread remote access, data-stealing malware (BleepingComputer)](https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/) - [NIKKE PC launcher compromise (Nov 2026): Level Infinite CDN files modified, remote-control agent, indicators (MotherSphere gist)](https://gist.github.com/MotherSphere/d6c049a09ba8ac3085c51ee9df24a4e5) - [NIKKE-Launcher-Check incident documentation (MotherSphere)](https://github.com/MotherSphere/NIKKE-Launcher-Check/blob/main/docs/incident.md) - [NIKKE-Launcher-Check indicator checks (MotherSphere)](https://github.com/MotherSphere/NIKKE-Launcher-Check/blob/main/docs/checks.md) - [NIKKE-Launcher-Check repository](https://github.com/MotherSphere/NIKKE-Launcher-Check) - ['Is My PC Infected?' Nikke Launcher Tampering Concerns: From Attack Vector to Remediation (Inven Global)](https://www.invenglobal.com/articles/28122/is-my-pc-infected-nikke-launcher-tampering-concerns-from-attack-vector-to-remediation) - [Goddess of Victory: NIKKE PC Launcher Tampered With by Third Party (Siliconera)](https://www.siliconera.com/goddess-of-victory-nikke-pc-launcher-tampered-with-by-third-party/) - [VirusTotal sample 4bfaf98a... referenced by BleepingComputer](https://www.virustotal.com/gui/file/4bfaf98a6b863fa79554d9eeeb18870c3f92d552d62f4bd35a72d19ea68526af) ## Full data The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp Canonical: https://intel.threadlinqs.com/threat/TL-2026-5252