{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "NIKKE PC launcher scripts on Level Infinite's CDN were tampered with to install remote-access, data-stealing malware · updates",
  "home_page_url": "https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026",
  "feed_url": "https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026/feed.json",
  "description": "Level Infinite, publisher of Shift Up's game Goddess of Victory: NIKKE (more than 45 million downloads), confirmed on Nov 4 2026 that the PC launcher's script files may have been tampered with by a third party and shipped a client fix and update at about 02:30 (UTC+9). Researcher MotherSphere says four JavaScript files on the official CDN were modified on Sept 27 2026 to load code from attacker domains each time the launcher opened. That code abused the launcher to run a LuaJIT payload, insight.bundle, which installed a remote-access agent called K2F able to run commands, browse and download files, take screenshots, steal NIKKE credentials and browser data, and install a persistent DLL (platform_experience_helper.dll). BleepingComputer found the DLL can steal crypto wallet recovery phrases and private keys from browser extensions; it is unknown whether that component was deployed or whether funds were stolen. The researcher says a tampered copy of one file was still being served after the update.",
  "language": "en",
  "_pwn": {
    "slug": "nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026",
    "severity": "high",
    "status": "live",
    "patchStatus": "partial",
    "rss": "https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026/feed.xml",
    "llms": "https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026/llms.txt",
    "json": "https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026#2026-11-04-316693e6",
      "url": "https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026#2026-11-04-316693e6",
      "title": "NIKKE PC launcher scripts on Level Infinite's CDN were tampered with to install remote-access, data-stealing malware: Level Infinite says the PC Launcher's script files may have been tampered with by a third party, and that client fixes and an update went out at about 02:30 (UTC+9). It is still investigating the scope of the impact.",
      "content_text": "NIKKE PC launcher scripts on Level Infinite's CDN were tampered with to install remote-access, data-stealing malware: Level Infinite says the PC Launcher's script files may have been tampered with by a third party, and that client fixes and an update went out at about 02:30 (UTC+9). It is still investigating the scope of the impact.\n\nSource: https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026#2026-11-04-22e8800f",
      "url": "https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026#2026-11-04-22e8800f",
      "title": "NIKKE PC launcher scripts on Level Infinite's CDN were tampered with to install remote-access, data-stealing malware: BleepingComputer confirms two of the modified files contain an obfuscated loader, and finds a DLL sample with code to steal crypto wallet data (recovery phrases and private keys) from browser extensions such as MetaMask, Phantom and Coinbase Wallet.",
      "content_text": "NIKKE PC launcher scripts on Level Infinite's CDN were tampered with to install remote-access, data-stealing malware: BleepingComputer confirms two of the modified files contain an obfuscated loader, and finds a DLL sample with code to steal crypto wallet data (recovery phrases and private keys) from browser extensions such as MetaMask, Phantom and Coinbase Wallet.\n\nSource: https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026#2026-11-04-763b1f55",
      "url": "https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026#2026-11-04-763b1f55",
      "title": "NIKKE PC launcher scripts on Level Infinite's CDN were tampered with to install remote-access, data-stealing malware: Shift Up founder Kim Hyung Tae says the studio is working with Level Infinite on a fundamental fix for the PC launcher issue and is preparing follow-up measures for players.",
      "content_text": "NIKKE PC launcher scripts on Level Infinite's CDN were tampered with to install remote-access, data-stealing malware: Shift Up founder Kim Hyung Tae says the studio is working with Level Infinite on a fundamental fix for the PC launcher issue and is preparing follow-up measures for players.\n\nSource: https://www.gamesradar.com/games/action-rpg/stellar-blade-studio-confirms-previous-game-nikke-was-hacked-launcher-script-files-may-have-been-tampered-with-by-a-third-party/",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://www.gamesradar.com/games/action-rpg/stellar-blade-studio-confirms-previous-game-nikke-was-hacked-launcher-script-files-may-have-been-tampered-with-by-a-third-party/",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026#2026-11-03-3aea3fb7",
      "url": "https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026#2026-11-03-3aea3fb7",
      "title": "NIKKE PC launcher scripts on Level Infinite's CDN were tampered with to install remote-access, data-stealing malware: Level Infinite replaces three of the four tampered launcher files with clean versions, per MotherSphere, who says a tampered copy of the fourth was still being served as of 22:26 GMT.",
      "content_text": "NIKKE PC launcher scripts on Level Infinite's CDN were tampered with to install remote-access, data-stealing malware: Level Infinite replaces three of the four tampered launcher files with clean versions, per MotherSphere, who says a tampered copy of the fourth was still being served as of 22:26 GMT.\n\nSource: https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/",
      "date_published": "2026-11-03T00:00:00.000Z",
      "external_url": "https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026#2026-09-27-bc68dd23",
      "url": "https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026#2026-09-27-bc68dd23",
      "title": "NIKKE PC launcher scripts on Level Infinite's CDN were tampered with to install remote-access, data-stealing malware: Four JavaScript files for the NIKKE PC launcher on Level Infinite's official CDN are modified to inject an obfuscated loader that fetches more code from attacker-controlled insightjs[.]com and insightjs[.]org whenever players open the launcher, according to researcher MotherSphere.",
      "content_text": "NIKKE PC launcher scripts on Level Infinite's CDN were tampered with to install remote-access, data-stealing malware: Four JavaScript files for the NIKKE PC launcher on Level Infinite's official CDN are modified to inject an obfuscated loader that fetches more code from attacker-controlled insightjs[.]com and insightjs[.]org whenever players open the launcher, according to researcher MotherSphere.\n\nSource: https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/",
      "date_published": "2026-09-27T00:00:00.000Z",
      "external_url": "https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/",
      "tags": [
        "high"
      ]
    }
  ]
}