# NIKKE PC launcher scripts on Level Infinite's CDN were tampered with to install remote-access, data-stealing malware · pwn.watch > Level Infinite, publisher of Shift Up's game Goddess of Victory: NIKKE (more than 45 million downloads), confirmed on Nov 4 2026 that the PC launcher's script files may have been tampered with by a third party and shipped a client fix and update at about 02:30 (UTC+9). Researcher MotherSphere says four JavaScript files on the official CDN were modified on Sept 27 2026 to load code from attacker domains each time the launcher opened. That code abused the launcher to run a LuaJIT payload, insight.bundle, which installed a remote-access agent called K2F able to run commands, browse and download files, take screenshots, steal NIKKE credentials and browser data, and install a persistent DLL (platform_experience_helper.dll). BleepingComputer found the DLL can steal crypto wallet recovery phrases and private keys from browser extensions; it is unknown whether that component was deployed or whether funds were stolen. The researcher says a tampered copy of one file was still being served after the update. Page: https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026 · generated 2026-11-04T19:41:22.834Z ## Status - Severity: high · status: live · patch: partial - Product: Goddess of Victory: NIKKE PC launcher (Level Infinite / Shift Up, Windows) - Started: 2026-09-27 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026.json - This file: https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026/llms.txt ## Updates (newest first) - 2026-11-04: Level Infinite says the PC Launcher's script files may have been tampered with by a third party, and that client fixes and an update went out at about 02:30 (UTC+9). It is still investigating the scope of the impact. (https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/) - 2026-11-04: BleepingComputer confirms two of the modified files contain an obfuscated loader, and finds a DLL sample with code to steal crypto wallet data (recovery phrases and private keys) from browser extensions such as MetaMask, Phantom and Coinbase Wallet. (https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/) - 2026-11-04: Shift Up founder Kim Hyung Tae says the studio is working with Level Infinite on a fundamental fix for the PC launcher issue and is preparing follow-up measures for players. (https://www.gamesradar.com/games/action-rpg/stellar-blade-studio-confirms-previous-game-nikke-was-hacked-launcher-script-files-may-have-been-tampered-with-by-a-third-party/) - 2026-11-03: Level Infinite replaces three of the four tampered launcher files with clean versions, per MotherSphere, who says a tampered copy of the fourth was still being served as of 22:26 GMT. (https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/) - 2026-09-27: Four JavaScript files for the NIKKE PC launcher on Level Infinite's official CDN are modified to inject an obfuscated loader that fetches more code from attacker-controlled insightjs[.]com and insightjs[.]org whenever players open the launcher, according to researcher MotherSphere. (https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/) ## Fix brief # Security brief: NIKKE PC launcher scripts on Level Infinite's CDN were tampered with to install remote-access, data-stealing malware Source: https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026 · status: live · severity: high · updated Nov 4, 2026, 17:43 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Level Infinite, publisher of Shift Up's game Goddess of Victory: NIKKE (more than 45 million downloads), confirmed on Nov 4 2026 that the PC launcher's script files may have been tampered with by a third party and shipped a client fix and update at about 02:30 (UTC+9). Researcher MotherSphere says four JavaScript files on the official CDN were modified on Sept 27 2026 to load code from attacker domains each time the launcher opened. That code abused the launcher to run a LuaJIT payload, insight.bundle, which installed a remote-access agent called K2F able to run commands, browse and download files, take screenshots, steal NIKKE credentials and browser data, and install a persistent DLL (platform_experience_helper.dll). BleepingComputer found the DLL can steal crypto wallet recovery phrases and private keys from browser extensions; it is unknown whether that component was deployed or whether funds were stolen. The researcher says a tampered copy of one file was still being served after the update. Severity detail: Official game launcher with a large install base silently ran a remote-access backdoor for about five weeks; the scope of impact is still under investigation - Product: Goddess of Victory: NIKKE PC launcher (Level Infinite / Shift Up, Windows) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you opened the NIKKE PC launcher since late September 2026, look for the string `k2f_chan registered` in `Launcher/intl_service/debug.log` in the NIKKE install folder; it means the Lua agent ran (it does not show whether the DLL loaded). Run a full antivirus scan; if compromised, reinstall Windows and change passwords, sessions and crypto wallet seeds from a clean device. Only reopen the launcher after updating and after Level Infinite confirms the issue is resolved. ## Latest updates - Nov 4, 2026: Level Infinite says the PC Launcher's script files may have been tampered with by a third party, and that client fixes and an update went out at about 02:30 (UTC+9). It is still investigating the scope of the impact. - Nov 4, 2026: BleepingComputer confirms two of the modified files contain an obfuscated loader, and finds a DLL sample with code to steal crypto wallet data (recovery phrases and private keys) from browser extensions such as MetaMask, Phantom and Coinbase Wallet. - Nov 4, 2026: Shift Up founder Kim Hyung Tae says the studio is working with Level Infinite on a fundamental fix for the PC launcher issue and is preparing follow-up measures for players. - Nov 3, 2026: Level Infinite replaces three of the four tampered launcher files with clean versions, per MotherSphere, who says a tampered copy of the fourth was still being served as of 22:26 GMT. - Sep 27, 2026: Four JavaScript files for the NIKKE PC launcher on Level Infinite's official CDN are modified to inject an obfuscated loader that fetches more code from attacker-controlled insightjs[.]com and insightjs[.]org whenever players open the launcher, according to researcher MotherSphere. ## Write-ups & news - [NIKKE PC game launcher hacked to spread remote access, data-stealing malware](https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/) - [Stellar Blade studio confirms previous game Nikke was hacked](https://www.gamesradar.com/games/action-rpg/stellar-blade-studio-confirms-previous-game-nikke-was-hacked-launcher-script-files-may-have-been-tampered-with-by-a-third-party/) ## Caveats Level Infinite has not disclosed technical details or how many players were affected. Mobile versions have not been reported as affected. The attacker's backup domain insightjs[.]org now shows an unofficial warning telling players to close the launcher; it is unclear who controls it. --- Machine-readable: https://pwn.watch/i/nikke-pc-launcher-cdn-scripts-tampered-k2f-malware-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.