NIKKE PC Launcher Supply Chain Compromise: K2F Remote-Control Agent Distributed via Official CDN Scripts

1. Basic Information

• Article Name: NIKKE PC launcher compromise (November 2026)
• Publisher: MotherSphere
• Publication Date: 2026-11-04
• Source Updated: 2026-11-05T08:18:00+09:00 (November 4, 23:18 GMT)
• Collection Date: 2026-11-05T08:02:41+09:00
• Source: MotherSphere
• Related Source: BleepingComputer: incident analysis
• Related Source: NIKKE official statement
• Related Malware: K2F remote-control agent, platform_experience_helper.dll
• Related Threat Group: None specified
• CVE: None specified
• Target Product/Service: GODDESS OF VICTORY: NIKKE PC launcher, Level Infinite CDN
• Severity: critical
• Severity Rationale: A remote-control agent was executed via the official launcher and official CDN, with potential access to arbitrary commands, files, screenshots, credentials, browser data, and re-execution from the cache.

2. Executive Summary

Four JavaScript files on the official Level Infinite CDN used by the NIKKE PC launcher were modified to deliver a LuaJIT-based K2F remote-control agent. The agent can execute commands and collect credentials, files, browser data, and screenshots. Its capabilities do not establish that every function ran or that all such data was stolen on every affected endpoint.

3. Attack Flow

Modules, Roles, and Scope

Sequence

1. The attacker inserts an obfuscated loader into four JavaScript files on the official Level Infinite CDN.
2. When a user starts the NIKKE PC launcher, its embedded browser loads modified scripts and retrieves additional code from insightjs-related domains.
3. Native launcher features retrieve and decrypt insight.bundle, starting the LuaJIT K2F agent.
4. K2F automatically collects NIKKE account information and establishes C2 communication. The operator can request command execution, file retrieval, screenshots, and browser data collection. These functions were not all confirmed as executed on every device.
5. A separate C2 instruction could deploy and register an additional DLL for persistence beyond launcher closure and collection of wallet information. Whether this happened on a specific endpoint must be checked independently.

4. Attacker Position and Execution Location

• An external attacker who managed to tamper with content delivered via the official Level Infinite CDN, operating compromised endpoints from a remote C2 server.

5. Victim and Administrator Perspective

Victims

• Users could become infected simply by opening the official launcher, potentially without any visible anomalies.

Administrators

• Indicators include k2f_chan registered in Launcher/intl_service/debug.log, tampered scripts in the cache, Lua payloads, DLLs, and insightjs network traffic.

6. Success and Failure Conditions

Success Conditions

• The launcher loads modified scripts during the affected period or from a stale local cache.
• The endpoint can reach the payload server, download insight.bundle, and start the LuaJIT agent.

Failure Conditions and Mitigations

Do not reopen the launcher before preserving relevant evidence.

7. Impact Upon Success

• Remote command execution, file viewing and downloading, and screenshots.
• Potential theft of NIKKE accounts, browser credentials, cookies, tokens, and SSH keys.
• Potential persistence and theft of wallet information via additional DLLs.

8. Observable Logs

Inference: The following are investigation and detection suggestions for an organization, not incident observations reported by the source. Use them where access, logging, and audit settings permit.

• Email: No incident-specific email entry vector has been disclosed.
• Proxy / SWG / DNS: Check launcher connections to insightjs.com, insightjs.org, and related IPs, and downloads of insight.bundle.
• Endpoint / EDR: Check k2f.lua, insight.bundle, k2f_chan in logs, LuaJIT activity, creation of platform_experience_helper.dll, and related registry registrations. Do not assume these use a Run key.
• Identity / IdP: Look for suspicious use of potentially exposed browser or developer-tool cookies and tokens on corporate and BYOD endpoints.
• SaaS / Cloud: Review CDN object changes and publisher-account activity where those records are available.
• Network: Review C2 communication, unusual file uploads, and command traffic originating from the launcher's embedded browser.

9. Attack Success Determination

• Malware Execution or Authentication Success Confirmed: Logs and artifacts from infected endpoints confirm K2F agent execution. k2f_chan registered indicates Lua agent execution, but additional DLL execution requires separate confirmation. (Scope: The endpoint analyzed by the researcher and submitted execution logs, not every endpoint that used the launcher.)

Distinguish script loading, payload download, execution, data theft, and follow-on compromise. One indicator does not establish every stage.

10. Investigation Playbook

Inference: The following are investigation and detection suggestions for an organization, not incident observations reported by the source. Use them where access, logging, and audit settings permit.

Trigger

• k2f_chan, insightjs traffic, modified launcher-cache scripts, or additional DLLs.

Initial Verification

• Check launcher execution times, version, cache, debug.log, DNS/proxy records, and endpoint IOCs.

Endpoints

• Preserve the launcher cache, Lua payloads, DLLs, registry data, memory, SRUM, and evidence of browser-data access.

Authentication and Cloud

• Audit NIKKE, browser sessions, email, SSH, and wallet-related account activity.

Subsequent Operations

• Investigate remote commands, file exfiltration, credential reuse, and wallet transactions.

Containment

• Isolate the endpoint and block IOCs. Preserve logs and cache before cache removal or OS rebuilding. Change affected credentials and revoke tokens and sessions from a clean device. If wallet secrets may have leaked, consider migration to a wallet with a newly generated seed.

Decision Categories

• Assess script loading, payload download, agent execution, DLL deployment, and data theft independently.

11. Defense and Detection Ideas

Inference: The following are investigation and detection suggestions for an organization, not incident observations reported by the source. Use them where access, logging, and audit settings permit.

Single Events

• Detect or block launcher traffic to suspicious insightjs.* domains and DLL writes outside the launcher directory.

Timeline Correlation

• Correlate launcher startup, insight.bundle download, k2f_chan log entries, and intermittent external POST traffic.

Threat Hunting

• Search corporate endpoints for NIKKE launcher execution, k2f_chan in debug.log, and DNS queries for related C2 domains.

Log Gaps

• Without endpoint file-write and network records, additional DLL deployment and actual data theft may be difficult to determine.

Priority Controls

• Enforce policies on personal software on work endpoints, application control, outbound filtering, and prompt rebuilding of compromised endpoints.

12. Facts / Inference / Hypothesis

Facts

• Level Infinite acknowledged possible third-party modification of NIKKE PC launcher scripts and applied client fixes and updates around 02:30 JST on November 4, 2026.
• The researcher identified attacker code in four official CDN JavaScript files dating from September 27, 2026, which the launcher loaded.
• Logs show that some launches retrieved insight.bundle and executed the LuaJIT K2F agent through native launcher features from at least October 23.
• K2F includes command execution, local file browsing and retrieval, screenshots, and collection of NIKKE credentials and browser information.
• An additional DLL includes functions targeting browser-extension wallet data and recovery phrases. Its actual deployment, execution, and any resulting cryptocurrency theft remain unconfirmed.
• At 11:20 GMT on November 4, the four files checked on four CDN servers were clean; modified scripts may still remain in local launcher caches.
• The analysis used infected-endpoint logs and artifacts and static analysis of retrieved payloads; the researcher did not execute the payload for analysis. Agent capabilities must be distinguished from commands actually executed and data stolen on individual endpoints.

Inference

• If the game was used on a work endpoint, corporate cloud-session cookies, SSH keys, or credentials stored there could have been exposed and could become an entry point into the organization.

Hypothesis

No additional hypotheses. Unconfirmed matters are listed under Open Questions and Further Research.

13. MITRE ATT&CK Mapping

14. Open Questions and Further Research

• The initial compromise vector for CDN write access, the total number of affected users, the distribution and execution scope of additional DLLs, and the exact count of stolen credentials and wallets remain unknown.

15. Impact on SOCs and Organizations

Consumer game launchers can also serve as software supply chain vectors on enterprise endpoints. In addition to applying official updates, investigate caches, debug logs, payloads, credential reuse, and wallet extensions.

16. Summary by Role

• SOCs: Correlate k2f_chan, insightjs domains, launcher caches, LuaJIT agents, additional DLLs, and credential use.
• Administrators: Update the launcher, investigate caches and IOCs, and isolate and rebuild compromised endpoints while addressing exposed credentials.
• Users: Check for IOCs around launcher-update times. If compromise is suspected, change passwords and revoke sessions from a clean device. If wallet secrets may have leaked, consider a wallet with a newly generated seed.