NIKKE PC Launcher Supply-Chain Attack Installed a Backdoor

TL;DR

• Attackers modified four official JavaScript files on Level Infinite's content delivery network. The NIKKE PC launcher loaded them and could install a remote-control agent called K2F.
• Anyone who opened the PC launcher between September 27 and the November 4 fix is at risk, on Windows, Linux, Steam Deck through Proton, or the Google Play Games build. The earliest reported agent start is October 23.
• Level Infinite confirmed the tampering on November 4 and replaced the files. The game has more than 45 million downloads. No CVE is assigned, and the incident is not in CISA KEV as of November 5, 2026.
• Clear the launcher cache, run the published checks, remove the Chrome persistence if it is present, and rotate every credential from a clean device. See "How do I fix it?".

Am I affected?

All of these conditions must hold for a machine to be exposed:

• The NIKKE PC launcher was opened between 2026-09-27, when the modified files appeared on the CDN, and the fix on 2026-11-04.
• The launcher ran the modified files from the network or from its cache. The loader fetched a second-stage bundle only on some launches.
• The machine is Windows, Linux or Steam Deck running the launcher through Proton, or the Google Play Games build. The mobile client is a different application and is not part of this incident.

The earliest reported agent start is 2026-10-23 at 16:40 GMT. The loader was in place from 2026-09-27, and the report says the payload ran on some launches only. One machine saw it on 3 of about 19 launches. The Google Play Games build installs to C:\NIKKE_GOOGLE, runs Launcher\nikke_launcher_google.exe and keeps its data in %APPDATA%\nikke_launcher_google.

Check the launcher log for the agent marker:

# Windows PowerShell
Select-String -Path "$env:APPDATA\nikke_launcher\intl_service\debug.log" -Pattern "k2f_chan"
# Linux or Steam Deck, inside the Proton prefix
grep -i "k2f_chan" "$WINEPREFIX/drive_c/users/$USER/AppData/Roaming/nikke_launcher/intl_service/debug.log"

k2f_chan registered means the agent was downloaded and ran. A launch can also log startup failed: EIO: invalid UTF-8 in string right after it, with no adopted or agent started as line, and that still means the agent ran.

How do I fix it?

1. Before you open the launcher again, run the checks in "How do I check if I was compromised?". The launcher cache holds some of the evidence.
2. Copy or delete the launcher cache folder. It can still hold the modified files and the launcher would load them again. The folder is %APPDATA%\nikke_launcher\tbs_cache, or %APPDATA%\nikke_launcher_hmt\tbs_cache and %APPDATA%\nikke_launcher_google\tbs_cache for the other builds. In a Proton prefix it sits under the same path inside the prefix.
3. Block the attacker's current domains and addresses in your hosts file, router or firewall:

text insightjs.com analytics.insightjs.com insightjs.org 89.127.233.127 89.126.250.172

This stops the server that is known today. The report says how the attacker got write access to Level Infinite's CDN is still unknown, so a new domain remains possible. 4. If the check finds k2f_chan, follow "What should I do if I installed it?". 5. Keep the launcher updated. Level Infinite rebuilt the front end on November 4 and replaced the four files. Confirm that your launcher loads the rebuilt script names listed in the report.

The vendor workaround is the client update and the cache deletion. The report gives no patch for the launcher code, because the flaw is not in the launcher binary: the official scripts on the CDN were modified.

What does the malicious code do?

The malicious code is a loader inserted into four legitimate launcher scripts. It runs when the launcher loads the script, resolves a C2 URL, downloads a LuaJIT payload, and starts a remote-control agent inside the launcher's own process.

The four modified files are:

The injected code hides the URL in an integer array with new TextDecoder().decode(new Uint8Array(new Uint32Array([...]).buffer)). It adds a <script> tag and removes it after loading. If insightjs.com fails, it retries with insightjs.org. In FeedList.feb647c9.js the added 708 bytes sit just before the final export{...} statement, so a check that compares only the end of the file misses them.

The loader calls the launcher's own download bridge, Srv_DownloadFile, to fetch https://analytics.insightjs.com/comm/assets/insight.bundle. The analyzed copy is 205,135 bytes with SHA-256 cc0ad05bfe85940a6067b3a72c182d3953339129206634141926d5d0b35973ec. The launcher saves it under a misleading .log name in Launcher\log\tinyget\, runs it, then deletes it. An earlier build saved it as k2f.lua and left it there. Any file in that folder that starts with the bytes 1B 4C 4A 01 is the agent.

The bundle is LuaJIT 2.0 bytecode for an agent internally named K2F_LUA_BUILD. It registers k2f_chan with the launcher's comm_center and then answers commands from the server. The agent does nothing on its own: every action comes from the operator through l.js.

How is it exploited?

1. A player opens the NIKKE PC launcher.
2. The launcher requests one of its normal script files from Level Infinite's CDN. The CDN serves the modified copy.
3. The inserted loader builds the insightjs.com URL and adds a script tag. If the first domain fails, it tries insightjs.org.
4. l.js profiles the launcher and calls the launcher's Srv_DownloadFile bridge to fetch insight.bundle from analytics.insightjs.com.
5. The launcher writes the bundle into Launcher\log\tinyget\ and runs it through its LuaJIT runtime.
6. The agent registers k2f_chan and contacts the C2. The operator can then send commands while the launcher is open.
7. On Windows the operator can install a Chrome DLL that keeps running after the launcher closes.

No user interaction beyond opening the launcher is needed. The loader runs on launch, and the report records agent starts from October 23.

How does the attack flow?

The four modified CDN files add a loader. The loader fetches a LuaJIT agent through the launcher's own download bridge. The agent gives the operator a remote shell inside the launcher process.

What can an attacker do?

The operator gets a remote-access agent inside the launcher process. The agent can run any command the player's account can run, read and download files, take screenshots, and collect saved credentials.

The published command list includes:

• exec, which runs any program or shell command and returns the output.
• ls, cd, cat, download and file_chunk, which browse folders and copy any file.
• screens, which captures every monitor.
• creds, which decrypts the NIKKE account and password that the launcher saved.
• browserscan, which reads saved passwords from Chrome, Edge, Brave, Vivaldi, Opera and Firefox, and cookies from the Chromium browsers.
• keyscan, which reads 264 credential and configuration paths and the Windows Credential Manager entries of developer tools.
• wallet_files, which reads data from 28 crypto wallet extensions in Chrome profiles.
• chrome_install, which installs the Chrome DLL persistence.

exec alone lets the operator do anything the user can do, including installing other malware. The agent runs elevated on the standard Windows launcher, whose manifest requests administrator rights, so the Chrome and Edge app-bound encryption paths can work. The agent stays active while the launcher is open, and the launcher often stays in the notification area while the game runs.

The impact needs the player to open the launcher during the exposure window. The report found no code for scheduled tasks, Run keys, services or the Startup folder, so persistence comes from the Chrome DLL or from commands the operator sends.

What should I do if I installed it?

1. Close the launcher or disconnect the machine from the internet, so the operator loses access.
2. Remove the Windows persistence. Delete HKCU\Software\Classes\CLSID\{E77CC89B-7401-4C04-8CED-149DB35ADD04} if it exists. Leave the HKLM copy alone: it belongs to Windows. Restart Windows, because the DLL stays locked while it is loaded.
3. Delete any subfolder under %LOCALAPPDATA%\Google\Chrome\User Data\PlatformExperienceHelper\ whose name is a 64-character hex string and that holds platform_experience_helper.dll. Do not delete the whole folder; Chrome creates it for its own helper.
4. From a clean device, change the NIKKE and Level Infinite password first, then email, Discord, banking and every password saved in a browser. Turn on two-factor authentication.
5. Log out of all sessions for Discord, Google, Steam, GitHub and the other services you use. Browser cookies work without the password.
6. Rotate API tokens, SSH keys and developer credentials, including GitHub, npm, AWS, OpenAI and Anthropic.
7. Move crypto wallet funds to a new wallet with a new seed phrase.
8. Reinstall Windows if the agent ran. The operator could execute any command, and Microsoft Defender Offline did not detect the DLL on one machine.

The report publishes a read-only checker, NIKKE Launcher Check, for Windows, Linux and macOS. It looks for the loader, the agent and the DLL, and it writes a report you save yourself.

How do I check if I was compromised?

The vendor published no indicators. The independent report publishes the following, and they are specific to this incident:

1. Search Launcher\intl_service\debug.log for k2f_chan. The lines lua downloaded to log\tinyget\, k2f_chan registered, adopted and agent started as show the agent ran. Copy the log before you delete the cache.
2. List Launcher\log\tinyget\. Files named tinyget.<time>.log or k2f.lua that start with 1B 4C 4A 01 are the agent.
3. Check the launcher V8 code cache at %APPDATA%\nikke_launcher\tbs_cache\Code Cache\js\. The loader keys dd65fa4d61079e7e_0, ce2fd3f1007a9fe9_0, 1416c638b3830103_0 and fd520c7c0f65c2d7_0 correspond to aegis, images, feedlist and vue.
4. Search the Local Storage leveldb under tbs_cache\Local Storage\leveldb\ for k2f.agent.state. The state survives deleting the NIKKE folder.
5. Check for %LOCALAPPDATA%\Google\Chrome\User Data\PlatformExperienceHelper\<64-hex>\platform_experience_helper.dll and the HKCU CLSID key from step 2 of "What should I do if I installed it?".
6. Compare network logs for the domains and addresses in "How do I fix it?". A lookup of insightjs.com after a playerinfinite.com request is a lead.

The launcher's debug.log is appended to, not overwritten, so an old entry can remain after a clean launch. The HTTP cache stores the modified scripts gzip-encoded, so a plain text search finds nothing; decompress each gzip stream and search for String.fromCharCode(111,114,103). A machine with no trace may still have run an early build that cleaned up after itself.

Timeline

• 2026-09-27 06:41 to 06:42 GMT: four official JavaScript files on Level Infinite's CDN are modified.
• 2026-10-23 16:40 GMT: the earliest agent start reported by a victim.
• 2026-10-28 15:46 GMT: FeedList.feb647c9.js is replaced with a clean copy at the origin, but some CDN servers keep the modified copy.
• 2026-11-03 17:04 to 17:23 GMT: the other three files are replaced on the CDN.
• 2026-11-04 03:12 to 03:21 GMT: the last CDN servers checked take the clean FeedList.feb647c9.js.
• 2026-11-04 03:13 GMT: Level Infinite confirms the tampering in a statement on X.
• 2026-11-04 11:20 GMT: all four files are clean on the four CDN servers checked.

FAQ

Is the mobile NIKKE app affected?

No evidence points to the mobile app. The tampered files are the PC launcher's scripts, and the report covers Windows, Linux and Steam Deck through Proton plus the Google Play Games build. The Google Play Games build runs on Windows, not on Android.

I opened the launcher but saw no warning. Was I infected?

Not necessarily. The payload ran on some launches only, and one machine saw it on 3 of about 19 launches. Check the log for k2f_chan and the tinyget folder for the LuaJIT header. A clean log lowers the likelihood but does not prove the machine was never infected.

Is the launcher safe to open now?

Level Infinite replaced the four files, and all four were clean on the servers checked at 11:20 GMT on November 4. Clear tbs_cache first, because the cache can still hold the modified copy. The report says how the attacker got write access to the CDN is still unknown.

Was this a ransomware attack?

No ransomware is reported. The agent is a remote-access tool that can steal credentials, cookies, wallet data and files. The report records no ransom note and no encryption.

Is there a CVE?

No CVE is assigned as of November 5, 2026. The incident is a supply-chain compromise of official scripts, not a vulnerability in a versioned package, and the vendor's statement gives no identifier.

References

• MotherSphere, "NIKKE PC launcher compromise (November 2026)", technical report and indicators (checked November 5, 2026). https://gist.github.com/MotherSphere/d6c049a09ba8ac3085c51ee9df24a4e5
• MotherSphere, "NIKKE Launcher Check", read-only checker (checked November 5, 2026). https://github.com/MotherSphere/NIKKE-Launcher-Check
• Level Infinite, statement on X, November 4, 2026 (checked November 5, 2026). https://x.com/NIKKE_en/status/2117817602659770434
• BleepingComputer, "NIKKE PC game launcher hacked to spread remote access, data-stealing malware", November 4, 2026 (checked November 5, 2026). https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/