NIKKE PC launcher hijacked to push K2F remote-access malware

Level Infinite, publisher of the gacha shooter Goddess of Victory: NIKKE (developed by Shift Up), confirmed that its PC launcher's script files "may have been tampered with by a third party," turning the launcher into a delivery channel for a remote-access agent. The confirmation, reported by BleepingComputer and CyberInsider, followed independent analysis by researcher MotherSphere. The company shipped a client fix and update around 02:30 (UTC+9) on November 4, 2026 and is still assessing scope.

What happened

According to MotherSphere's analysis, four JavaScript files on Level Infinite's CDN were modified — timestamps point to September 27, 2026, with the earliest observed infections around October 23–24. When a player opened the launcher, the injected code pulled a LuaJIT payload, insight.bundle, which installed a remote-access agent the researcher calls K2F. Per the writeup, K2F can run commands, browse and download files, capture screenshots, collect NIKKE account credentials, and steal browser-stored data. A follow-on component, platform_experience_helper.dll, could persist after the launcher closed; BleepingComputer found wallet-theft code in that DLL targeting extensions such as MetaMask and Phantom. Whether that component was deployed, or any crypto stolen, is not confirmed.

Caveat: the tampering timeline, the K2F capabilities and the indicators below come from MotherSphere's research, relayed by BleepingComputer, which independently confirmed some of the JavaScript behavior. Level Infinite has confirmed the tampering but has not published its own findings.

Timeline

• Sept 27, 2026: launcher JavaScript files reportedly modified (based on timestamps).
• ~Oct 23–24: earliest observed infections.
• Nov 3: three of the four files reportedly replaced with clean versions; a tampered fourth copy reportedly still served afterward.
• Nov 4, 02:30 (UTC+9): client fix and update released.
• Nov 5: publisher posts instructions for checking machines for compromise.

NIKKE has over 45 million downloads since 2022; the number of affected PC-launcher users has not been disclosed.

Indicators of compromise

Published by MotherSphere and relayed by BleepingComputer (via its VirusTotal reference):

Domains:
  insightjs[.]com   (primary)
  insightjs[.]org   (fallback)

Files:
  insight.bundle
  platform_experience_helper.dll

Persistence/agent log string (in <NIKKE install>\Launcher\intl_service\debug.log):
  k2f_chan registered

platform_experience_helper.dll (SHA-256):
  4bfaf98a6b863fa79554d9eeeb18870c3f92d552d62f4bd35a72d19ea68526af

The k2f_chan registered string indicates the Lua agent ran, but not that the DLL loaded.

Action checklist

1. Do not open the NIKKE PC launcher until the publisher confirms the files are clean; clear its cache before next use.
2. Check Launcher\intl_service\debug.log in your NIKKE install directory for k2f_chan registered.
3. If you find that string — or the files/hash above — treat the host as fully compromised. Reinstall Windows, then change passwords and rotate any crypto-wallet keys from a different, clean device.
4. Rotate your NIKKE credentials and any passwords stored in browsers on the affected machine.
5. Run a full scan with an updated AV product regardless.

Context

This is the familiar shape of a software-supply-chain hit: not an exploit against the user, but a trusted updater pulling attacker code from a CDN the publisher controls. Game launchers are a soft target — always running, auto-updating, and run by audiences who also hold crypto wallets, which the MetaMask/Phantom-targeting DLL suggests was the point. The useful habit it reinforces: a "launcher" is just another auto-updater with network access, and it deserves the same scrutiny as any other.