2026 NIKKE (Level Infinite) — PC launcher script files tampered with to install a remote-access and data-stealing agent

2026 Unknown records affected

Data compromised

On infected PCs, K2F could run commands, browse and download files, take screenshots, collect NIKKE credentials and steal browser data. An optional DLL (platform_experience_helper.dll) could persist and target crypto-wallet extensions such as MetaMask, Phantom and Coinbase Wallet; it is not known whether it was deployed. No count of affected players has been given.

Technical writeup

Indicator: the string "k2f_chan registered" in Launcher/intl_service/debug.log shows the Lua agent ran (not whether the DLL loaded). Advice for compromised players is to reinstall Windows and change passwords from a clean device. The game has over 45 million downloads, mostly mobile; only the PC launcher was affected.

Root cause

The publisher of Goddess of Victory: NIKKE said "the PC Launcher's script files may have been tampered with by a third party." Researcher MotherSphere says four JavaScript files were modified on September 27, 2026, and three were replaced with clean versions on November 3. The tampered scripts loaded code from insightjs[.]com, with insightjs[.]org as a fallback, which dropped a LuaJIT payload (insight.bundle) that installed a remote-access agent called K2F. A client fix shipped on November 4 at about 02:30 UTC+9.

References

https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/

Data compromised

Technical writeup

Root cause

References

Breaches you may like