Severity: High | Priority: 1
The official PC launcher for the game NIKKE: Goddess of Victory, published by Level Infinite, was used to spread malware through a supply-chain compromise. On 27 September 2026, an attacker modified four JavaScript files on the publisher’s own content delivery network. The launcher loads these files into its built-in browser every time it starts. Each modified file carried a small hidden loader that fetched more code from attacker-controlled insightjs domains. From 23 October, some launches then downloaded and ran a larger encrypted payload called insight.bundle. It runs inside the launcher as a remote-control agent known as K2F. Because the files came from the publisher’s legitimate servers through a trusted application, users had no warning signs. Level Infinite acknowledged the issue and replaced the files on 3 and 4 November, but modified copies may still sit in launchers’ local caches.
While the launcher is running, the K2F agent lets the attacker:
On command, the attacker can also drop a separate stealer DLL into the Chrome profile folder. It is built individually for each victim and kept running through a hijacked per-user COM registry entry, and it targets browser-extension cryptocurrency wallets and their recovery phrases. Anyone who ran the launcher during the affected period should assume their saved passwords, browser sessions and wallet secrets may have been exposed.
On any affected computer, keep the launcher closed and preserve evidence before cleaning up. Then delete the launcher’s tbs_cache folder. Check the launcher’s intl_service debug log for the text k2f_chan, and look in the Chrome User Data folder for an unexpected file named platform_experience_helper.dll. Also check the current user’s registry for the COM entry {E77CC89B-7401-4C04-8CED-149DB35ADD04} pointing into a browser folder. The matching entry under the machine-wide registry hive is legitimate and should be left alone. Block the domains insightjs.com and insightjs.org and the addresses 89.127.233.127 and 89.126.250.172. Where the agent is confirmed to have run, reinstall Windows. From a clean device, move any cryptocurrency to a new wallet with a fresh recovery phrase, then change passwords and end active sessions for email, password managers, banking, developer and cloud accounts, game accounts and everything else saved in the browser. Organisations should also check whether the NIKKE launcher is installed on managed machines and remove it where it is not permitted.