NIKKE PC Launcher CDN Compromise: How to Check Windows for the K2F Backdoor

What Level Infinite has confirmed​

The official statement is brief. In a notice on X, the NIKKE team said "We have identified an issue indicating that the PC Launcher's script files may have been tampered with by a third party." BleepingComputer reports the statement also said client fixes and an update went out at about 02:30 Korea time (UTC+9) on November 4. That is 17:30 UTC on November 3. The company said it is still investigating the impact and will publish follow-up measures in a separate notice.

The statement does not name the affected files, describe the malware, or tell players what to do. When BleepingComputer published, Level Infinite had not answered its questions about the researcher's findings.

NIKKE is a sci-fi shooter RPG for Windows, iOS and Android. BleepingComputer cites Level Infinite's figure of more than 45 million downloads since the 2022 launch. A large player base and a launcher that pulls in web content every time it starts made this a valuable target.

Summary: The company has confirmed tampering and a fix. It has not disclosed how many players were affected, how the attackers got in, or what data was taken.

How the attack worked​

Most of the technical detail comes from a GitHub report by independent researcher MotherSphere. Since then it has been updated with findings from other victims. It says four official JavaScript files on Level Infinite's CDN were changed on September 27, 2026: aegis-fix.min.js, vue-bucket.min.js, images.7fec4c32.js and FeedList.feb647c9.js. Because the desktop client pulls dynamic web assets during boot-up, compromised systems loaded the altered files straight into memory.

The infection had several stages:

1. Loader: Obfuscated code hidden inside the real files loaded a script from insightjs[.]com. If that domain failed, it tried insightjs[.]org. BleepingComputer examined two of the modified files and confirmed the loader and the fallback. MotherSphere found that the attacker's URL was stored as an array of integers. In FeedList.feb647c9.js, the 708 extra bytes sat just before the module's final export statement. A check that only compares the end of each file would miss them.
2. Payload: The next stage used the launcher's own download feature to fetch a LuaJIT payload called insight.bundle. The payload installed a remote-access agent that MotherSphere calls K2F.
3. Remote control: The backdoor allowed attackers to remotely execute commands, browse and download local files, capture screenshots, collect NIKKE account credentials, and steal information stored in web browsers.
4. Persistence: The malware also supported an additional command to install a malicious Windows DLL named platform_experience_helper.dll that could remain active after the game launcher was closed.

BleepingComputer examined strings from a DLL sample on VirusTotal. It found code aimed at crypto wallet browser extensions, including MetaMask, Phantom and Coinbase Wallet, and at recovery phrases and private keys. Nobody knows yet whether the attackers actually installed this DLL on victims' PCs or stole any cryptocurrency.

MotherSphere's report adds some details that matter on Windows:

• The agent only waits for orders. It does nothing until the attacker's server sends a command, and it stays active as long as the launcher is open. The launcher often sits in the notification area while the game runs. One victim's agent reportedly checked in 22 times over nine hours.
• Admin rights may have helped. One contributor reported that nikke_launcher.exe version 0.0.6.841 asks for administrator rights in its manifest. If so, the agent ran elevated. That would let it try a SYSTEM-token method against the app-bound encryption Chrome and Edge use for saved credentials. This is a reported finding, not a confirmed one.
• Standard process logs may not show it. Only the exec command starts new programs. Everything else runs inside the launcher process, so Prefetch and process-creation logs won't show it. All network traffic goes through the launcher's built-in browser, tbs_browser.exe on Windows, so look for that process in firewall and SRUM records.
• There were several versions. The researcher counts at least seven uploads of the payload. The October 23 version had fewer modules and no wallet-extension targets. A single file hash will not match every infection.

Summary: Official launcher files carried the attack. The agent could do anything the logged-in user could do, and on Windows it could leave a DLL behind that keeps running after the launcher closes.

Timeline: modified in September, fully cleaned in November​

Several outlets have repeated these dates. CyberInsider notes that the earliest reported instance of the malware running dates to October 23, although timestamps on the altered scripts date back to September 27. BleepingComputer's report that a tampered file was still being served after the fix was correct at the time. Later checks found the servers clean. Those checks covered only the servers that were tested, and a clean CDN does nothing for a PC that has already run the payload.

The insightjs[.]org fallback domain has an odd history. MotherSphere says nobody had registered it until November 3. It was registered that evening and now shows a warning, in English, Chinese, Japanese and Korean, telling players to close the launcher. The page calls itself an independent notice, not an official one. It is not clear who controls the domain, but it was not a working attacker server. If a player sees that warning, their launcher ran a stale modified file and tried the fallback domain.

Who is affected​

• Windows PC players who opened the launcher from October 23 (at the latest) until the fix. This also includes anyone whose launcher was still loading cached modified files or reaching an outdated CDN server.
• Linux and Steam Deck players using Proton. The reported attack involved the PC launcher, including when run through Proton on Linux and Steam Deck. The Windows DLL persistence does not apply there. However, MotherSphere points out that Wine maps the Linux home folder to a drive letter, so the operator could read ~/.ssh, browser profiles, API keys in shell config files and other personal files.
• Mobile players do not appear to be affected. Game8 reports no evidence that the native Android or iOS versions were affected.

The researcher also traced the claim that "all Tencent games were hacked" to a single anonymous post with no evidence behind it. No other game's launcher is known to have loaded this loader.

How to check your PC​

Do these checks before you open the launcher again.

1. Check the main indicator. Open Launcher\intl_service\debug.log in the NIKKE install folder and search for k2f_chan registered. A match means the Lua agent ran. It does not show whether the DLL was installed. MotherSphere says the launcher keeps adding to this log, so it can show older sessions, but the log is gone if you deleted or reinstalled the game.
2. Check the launcher's local storage. Search the files in %APPDATA%\nikke_launcher\tbs_cache\Local Storage\leveldb\ for k2f.agent. A match is meaningful. No match proves less, because the entry can end up inside compressed .ldb files where a plain text search won't find it.
3. Check the script cache. The loader leaves files with the same names on every infected machine under tbs_cache\Code Cache\js\. Examples include dd65fa4d61079e7e_0 and ce2fd3f1007a9fe9_0.
4. Check the download logs. In Launcher\log\tinyget\, a request for insight.bundle counts only if a later line for the same task shows the download succeeded. A line showing result=2 and total=0 means the download failed. Any file in that folder that begins with the bytes 1B 4C 4A 01 is the agent.
5. Check DNS and router logs. A lookup of insightjs.com means the loader ran. A lookup of analytics.insightjs.com most likely means the agent stage was reached. If your PC also uses a second DNS server, such as an IPv6 server from your router, those logs may not show every lookup.
6. Clear the launcher cache. Copy %APPDATA%\nikke_launcher\tbs_cache somewhere safe as evidence, then delete it. MotherSphere warns that the cache can still hold the modified files, and the launcher would load them again.

Missing evidence does not mean you're safe. The agent deletes its temporary screenshot and credential copies right after reading them. A collect_cookies: false setting doesn't mean cookies were left alone. MotherSphere also warns that some infected PCs showed no unusual upload activity in SRUM.

If you find signs of infection​

BleepingComputer's advice is to run a full scan with up-to-date antivirus software. If you find signs of compromise, reinstall Windows and change your passwords and other credentials from a different, clean device. CyberInsider says the researcher also recommends reinstalling, because the attacker could have installed additional malware. The exec command gave the attacker full command execution, so a scan that finds nothing does not guarantee the PC is clean.

Next, in rough order of importance:

• Sign out of all active sessions for your email, game store and other important accounts. Stolen cookies can keep those sessions open even after you change passwords.
• If a crypto wallet extension was installed in that browser, move the funds to a newly created wallet. No theft has been confirmed, but the DLL was built to collect seed phrases.
• Developers should revoke and replace SSH keys, cloud tokens and API keys. On Proton, assume every secret in your home folder and environment variables was exposed.
• MotherSphere advises keeping the attacker's domains blocked at the firewall or router, because nobody knows how the attacker got write access to the CDN.

Analysis: another supply-chain attack that came through a trusted channel​

This attack relied on the launcher trusting its own publisher's CDN completely. Players trust the launcher, the launcher trusts the CDN, and the attackers got into the CDN. Code signing for the launcher executable didn't help, because the malicious code arrived as web content after the program started. A launcher that requests admin rights and runs an embedded browser carries a lot of risk if it never checks the integrity of the scripts it loads.

There is also an imbalance in how the incident was handled. An independent researcher and a group of victims comparing their logs produced detailed indicators, timelines and file hashes. The official notice gave players no steps at all. MotherSphere's suggestion that the next launcher update force a cache reset is sensible. So would a statement on how the CDN was compromised and how long it was exposed.

Until Level Infinite publishes more, run the checks above before you reopen the launcher. If you find a match, rebuild the PC instead of relying on a scan.