NIKKE launcher malware: official files tampered for 37 days

Open your NIKKE install folder, find Launcher\intl_service\debug.log, and search for k2f_chan.

If it’s there, your PC ran a remote-control program at some point. It can run arbitrary commands, read any file and take screenshots, and it goes looking for your browser passwords, SSH keys, crypto wallets, and the login credentials of AI tools like Claude Code, Codex and Gemini CLI.

From November 3, warnings appeared on the NIKKE community Discord, NGA, the NIKKE board on Bahamut (a major Taiwanese gaming forum), and in English-speaking communities. A self-check post on NGA by an infected player puts it bluntly: if you can find the k2f_chan string, the information listed has already been stolen. There’s also a thread on Bahamut, but that page wouldn’t load for me, so I don’t quote it below.

For this piece I read two public technical analyses: MotherSphere’s continuously updated incident report on GitHub Gist, and WormW’s reverse-engineering report. I also checked the domain registration data and certificate transparency logs myself, and compared them with reporting from Inven Global and others. A few widely shared claims need correcting, and some containment steps are missing from the NGA list; following that list as-is could damage your system.

The short version: who should worry?

Figure 1: The warning box at the top of MotherSphere’s report, last updated November 4 at 02:00 GMT (source: GitHub Gist)

The warning box at the top of the report lays it out: from September 27, 2026, four official JavaScript files on Level Infinite’s CDN contained attacker code. The NIKKE PC launcher loads these files. From October 23 at the latest, opening the launcher could install a remote-control agent, and while the launcher was open the attacker could run any command on your machine, read any file and take screenshots.

So the people affected are:

• Anyone using the official PC launcher. Both analyses so far cover only the PC launcher.
• Anyone who opened the launcher between late September and November 3. The earliest reported agent start is October 23, but MotherSphere says there isn’t enough data on early October to rule it out.
• Steam Deck and Linux players on Proton too. MotherSphere’s report says explicitly that “Proton does not protect you”: Wine maps the whole root and home directories, so the agent can still read ~/.ssh and browser data.

Not every launch triggers it. On the machine MotherSphere analyzed, about 3 of roughly 19 launches received the malware.

“An expired domain got snatched” is only half right

The first line of the NGA post’s timeline reads “insightjs.com re-registered (expired domain snatched).” Many retellings took that to mean the launcher had always used an analytics service called insightjs, the domain lapsed, a hacker registered it, and so whatever the launcher loaded became malware.

The domain was indeed re-registered after lapsing. I could confirm that myself.

Figure 2: insightjs.com certificates indexed by crt.sh, checked November 4 (source: crt.sh)

The crt.sh records fall into two parts. From August 2019 to June 2021, Amazon’s certificate authority issued around twenty certificates for api.insightjs.com and cdn.insightjs.com, which looks like a normally operating product. After June 26, 2021 there’s a gap of more than five years. The next one is from Let’s Encrypt for analytics.insightjs.com on October 6, 2026.

I also checked Verisign’s RDAP registration data: insightjs.com was created on September 27, 2026 at 01:59:19 UTC, through PDR Ltd., with name servers at 1984, a hosting provider in Iceland.

The other half of the claim doesn’t hold. Neither technical report says the launcher ever used insightjs.com before. What they describe is this: the attacker registered the domain at 01:59, and four hours and forty minutes later, between 06:41 and 06:42, official files on Level Infinite’s CDN were modified to add code that loads insightjs.com.

In other words, the line pointing at insightjs.com was written into the official files by the attacker. Picking the domain of an analytics service that really existed in 2019 just made that line look less out of place. WormW’s report classifies it as infrastructure the attacker deliberately picked up, on the grounds that its name and its 2019 history make it look like a genuine monitoring or analytics service.

The distinction matters. If a third-party dependency had lapsed and been snatched, the problem would be a forgotten external reference, and the fix would be auditing external scripts. Here someone got write access to the official CDN, and the fix is finding out how that access leaked. Both reports say that’s currently unknown: WormW lists leaked CDN credentials, a compromised CI/CD pipeline and misconfiguration as “hypotheses to verify,” and MotherSphere writes that “how the attacker got write access to Level Infinite’s CDN is not known yet.”

One small point. Citing Cert Spotter, MotherSphere lists an insightjs.com certificate from September 27 at 03:00 and a multi-subdomain certificate from October 23. Neither shows up in the crt.sh capture above. WormW also says the multi-subdomain certificate was found by connecting directly, and that CT only showed the analytics one. Different CT search services index differently, and I can’t tell which one missed what.

How did the malware get onto your PC?

Figure 3: The attack chain as compiled for this article (data: MotherSphere, WormW)

The NIKKE PC launcher is essentially a program wrapped around a browser. The announcements, images and news list in its interface are web content loaded from Level Infinite’s sites and CDN.

The modified files live under playerinfinite.com. MotherSphere lists four: aegis-fix.min.js, images.7fec4c32.js, FeedList.feb647c9.js and vue-bucket.min.js. WormW’s report lists only the first three and leaves out vue-bucket.min.js. The press split the same way: of Inven Global’s two reports, one says three files and the other says four. MotherSphere gives a SHA-256 for the modified vue-bucket.min.js, so I lean toward four, but that’s my judgment.

What was added to each file is small. It hides the URL in an array of integers, rebuilds it at runtime, inserts a script tag to load insightjs.com/l.js, and removes the tag once it loads. If .com doesn’t respond, it tries insightjs.org instead.

Next comes the real breach. The launcher exposes some native functions to its own web pages, and one of them downloads files. The malicious l.js calls that function to fetch a file of about 205 KB from analytics.insightjs.com, saves it in Launcher\log\tinyget\ with a .log extension as cover, runs it, then deletes it. WormW’s report describes this as remote JavaScript being able to call the launcher’s native download-and-execute capability.

That file is obfuscated LuaJIT 2.0 bytecode. It has no networking of its own. It registers a channel called k2f_chan with the launcher’s communication center and waits for commands. Everything travels through the launcher’s embedded browser (tbs_browser.exe on Windows).

That’s why debug.log ends up with the two lines "k2f_chan registered" and "adopted ...", which is what the NGA self-check relies on.

The last step is persistence, and it happens only on Windows. The agent creates a folder with a 64-character hex name under %LOCALAPPDATA%\Google\Chrome\User Data\PlatformExperienceHelper\, drops platform_experience_helper.dll into it, and writes that DLL’s path to HKCU\Software\Classes\CLSID\{E77CC89B-7401-4C04-8CED-149DB35ADD04}\InprocServer32, hijacking a COM component. The DLL keeps running after the launcher is closed.

What does “K2F” stand for? WormW says it’s the family’s brand string, showing up in internal names and in the CN of the attacker’s back-end certificate, but the report doesn’t explain it and I couldn’t find out either.

Timeline: 37 days, and still not fully cleaned up

Figure 4: Timeline compiled for this article, all times converted to UTC; add 8 hours for Taiwan (data: crt.sh, RDAP, MotherSphere)

The sources use different time zones: NGA uses local time, MotherSphere uses GMT, and Inven’s Korean reporting uses Korean time. I converted everything to UTC and lined it up.

From the files being modified at 06:41 on September 27 to the official replacement of the first file at 17:04 on November 3 is 37 days and a little over 10 hours. That’s where the 37 days in the headline comes from, and it’s a lower bound.

FeedList.feb647c9.js is more complicated. MotherSphere says it was swapped back to a clean version at the origin on October 28, but the CDN caches, and at 22:26 GMT on November 3 two CDN nodes were still serving the modified file. WormW checked again between 02:01 and 02:07 UTC on November 4 and got the same result, with Last-Modified still at 06:42:03 on September 27. WormW’s report says plainly that “the official fix is incomplete.”

The attacker was busy too. The sample compile time in the NGA timeline, 18:52:01 UTC on October 29, matches the compile timestamp of the DLL WormW analyzed; WormW notes that value can be forged and only counts because it fits the other evidence. MotherSphere recorded five different payload builds uploaded to the attacker’s server between November 1 and 3, the last at 14:56 on November 3, a little over an hour before the public warning.

At 18:31 UTC on November 3, which is 2:31 a.m. on November 4 in Taiwan and China, the attacker’s server stopped responding. That’s what the NGA post’s “2:30 update” refers to.

That update has a second half. It says the code fell back to insightjs.org, that this domain was “registered today by some kind soul,” and that the launcher notice players were seeing wasn’t from the publisher but was pushed by that person through insightjs.org.

What I can verify: insightjs.org was registered at 17:55:42 UTC on November 3 through Spaceship, with name servers at Cloudflare, and both reports say it’s now a warning page with the malicious payload path returning 404. What actually appeared in the launcher I can’t see; that’s the NGA author’s account.

The episode does point to a problem, though, and what follows is my inference: modified official files are still sitting on some CDN nodes and in players’ caches, and they load the .org script when .com fails. Whoever holds insightjs.org can run JavaScript in those launchers. This time the holder appears to be well-meaning, but that path stays open until the publisher clears every file and cache.

What does it steal? One entire category is AI tools

The NGA list is already long; the two technical reports add detail and numbers.

Figure 5: Targets WormW decoded from the agent’s string table, showing the categorized portion (data: WormW report)

WormW decoded about 1,790 target paths from the program’s string table. The categorized portion breaks down as: AI/LLM tools 70 paths, cloud and DevOps 154, version control and SSH/GPG 88, browsers 66. The report doesn’t break the remaining paths down by category.

The AI category lists Claude Code and Claude Desktop config and credentials, OpenAI Codex’s auth.json, Gemini CLI’s oauth_creds.json, Cursor, Windsurf, Aider, Copilot CLI’s MCP config, HuggingFace tokens and more. MotherSphere’s target list names ~\.claude\.credentials.json directly. The state.vscdb files where VS Code, Cursor and Windsurf store secrets are on the list too, and the program pulls fields related to tokens, secrets, API keys and passwords out of them.

So what does this have to do with you? If you play NIKKE and write code on the same PC, what was taken may go well beyond your game account: API keys that can spend your money directly, and SSH keys that can log into your company’s servers.

The rest, as listed:

• Remote control: run any program or shell command, browse and download any file, capture every monitor.
• NIKKE account: decrypts the account and password the launcher stores in psd.dat and last_user.dat.
• Browsers: saved passwords and cookies from Chrome, Edge, Brave, Vivaldi, Opera and Firefox.
• Developer credentials: ~/.ssh, .git-credentials, PuTTY and WinSCP sessions, Docker, GitHub CLI, npm and cloud CLI logins, shell history, and .env files in project folders.
• Token-format scanning: any file it reads is matched against 35 prefixes, such as GitHub’s ghp_, GitLab’s glpat-, Stripe’s sk_live_ and Slack’s xoxp-.
• Crypto wallets: 28 browser wallet extensions including MetaMask, Phantom and OKX. MotherSphere notes wallet files are read from Chrome profiles only.

How much was taken? MotherSphere cites figures victims reported from Windows SRUM records: one machine sent about 947 KB within seconds of the agent starting, and another sent 146 MB in one hour. These are victim reports, marked as not verified by the author.

Checking yourself: finding k2f_chan means you’re hit, not finding it doesn’t clear you

The NGA self-check post says that if k2f_chan is present you’re infected, that the Chrome persistence doesn’t necessarily run, and adds “stop asking about Chrome not having that file.” Both technical reports back this up, for two reasons.

First, k2f_chan registered means the agent has started on your PC and connected to the attacker’s server. Whatever commands it ran afterward leave no trace at all in the launcher logs. MotherSphere’s advice is to “assume the worst.”

Second, installing the DLL doesn’t require Chrome. The agent creates the folder itself and never checks whether Chrome exists. So “I don’t have Chrome” doesn’t mean you’re fine, and “I can’t find that DLL in the Chrome folder” doesn’t mean nothing was taken.

The reverse also holds: not finding k2f_chan doesn’t prove you’re clean. MotherSphere says data on early-October infections is thin, and a clean log can’t rule out that window. It also mentions a machine where a Windows Defender Offline scan didn’t catch the DLL, so a clean antivirus result doesn’t mean it isn’t there.

Besides debug.log, the two reports list a few other places to check:

• Whether the launcher’s Local Storage (%APPDATA%\nikke_launcher\tbs_cache\Local Storage\leveldb\) contains the key k2f.agent.state.
• Whether logs under Launcher\log\tinyget\ contain the line lua downloaded to log\tinyget\.
• Whether %TEMP% contains k2f-bcreds-*.db or k2f_screen_*.jpg, though these are deleted right after use.
• On Windows, the SRUM network usage records; MotherSphere says this is the only place that can measure how much data left the machine.

WormW’s GitHub also includes YARA and Suricata rules. If you handle endpoint or network monitoring at work, you can use them directly; WormW warns that two of them are for hunting only and shouldn’t be used to block without tuning.

Containment: a few details the NGA list leaves out

Figure 6: The order of steps compiled from both reports (data: MotherSphere, WormW)

The NGA list of “what to do if you’re hit” points the right way: change every password saved in your browser, replace private keys and server passwords, move to new wallets, reinstall the OS. The two technical reports go further in a few places, and skipping some of these details can cause trouble.

Change passwords from a different, clean device. If the agent is still running, a new password typed on the infected PC will be seen too. MotherSphere’s suggested order is NIKKE first, then email, Discord, online banking and any other account saved in the browser, with two-factor authentication turned on everywhere and every signed-in session logged out.

Signing out and revoking matter more than changing passwords. Stolen cookies let an attacker log in without a password, so every session needs to be kicked. API keys, SSH keys and cloud credentials need to be revoked and reissued, not just have their passwords changed. WormW suggests working through its collection list item by item, in this priority: AI tool API keys and OAuth tokens, VS Code-family secret stores, keys in MCP configs, cloud keys, package registry tokens, CI and Kubernetes credentials, SSH/GPG keys, browser sessions. If you use Claude Code, Codex or Gemini CLI, revoke your existing keys in each provider’s console and sign in again.

A wallet can’t be changed, only moved. Once a seed phrase leaks it can’t be “changed.” The only option is to create a new wallet with a new seed and move your assets to it.

Delete only the HKCU registry key. The {E77CC89B-7401-4C04-8CED-149DB35ADD04} CLSID already exists under HKLM on every Windows install, pointing to wpc.dll, the parental controls component. The malicious one is the copy under HKCU. Deleting the wrong one touches a system component.

Delete only the subfolder with the 64-character hex name. The PlatformExperienceHelper folder itself is normal Chrome, and Chrome’s install directory also has a Google-signed executable with the same name. The malicious part is the 64-character hex subfolder inside it and the unsigned platform_experience_helper.dll within. MotherSphere’s steps are to delete the registry key, restart, and then delete the file, because victims report the DLL is locked while loaded.

Reinstalling is still the safest option. Both reports say so. The agent could run arbitrary commands, and you can’t be sure it left nothing else behind.

A hosts file only blocks the current batch. The NGA post suggests pointing three domains at 0.0.0.0. That’s a reasonable stopgap for people who aren’t infected, but it’s useless once the attacker switches domains. MotherSphere also lists two IPs, 89.127.233.127 and 89.126.250.172, which likewise only cover the current infrastructure.

Don’t open the launcher until it’s fixed, and clear the cache before you do. The publisher says it has fixed the problem (see the next section), but some CDN nodes kept serving modified files after that, and modified files may also still be in your own PC’s cache. Both reports recommend deleting %APPDATA%\nikke_launcher\tbs_cache; Proton users need to delete the copy inside the Wine prefix.

What has the publisher said so far?

Very little, and late.

Inven Global’s English report on November 3 says neither SHIFT UP nor Level Infinite had commented publicly at the time of writing. A second report the same day, translated from the Korean edition, says that as of the morning of November 4 neither company had posted a statement on its official channels. Reports from Enduins and Gurugamer on November 4 say the same.

Level Infinite did respond after that. According to BigGo’s report, Level Infinite said on November 4, in a notice on its official game community and on its official Japanese X account, that it had confirmed an anomaly in which script files in the PC launcher may have been tampered with by a third party, that it carried out a client fix and update at around 2:30 a.m. that day, that it is checking the scope of impact, and that follow-up measures will come in a separate notice. I haven’t read the official wording itself; this follows BigGo’s account. BigGo’s timeline marks that 2:30 a.m. as Korean time, which is 17:30 UTC on November 3, roughly in line with the three file replacements both reports recorded between 17:04 and 17:21.

So what the publisher acknowledges is “may have been tampered with” and “fixed.” It doesn’t say how long the files were modified, whether any player’s PC received the agent, what was taken, or what players should do. And MotherSphere at 22:26 GMT on November 3 and WormW at 02:07 UTC on November 4 both still saw FeedList served in its modified form by some CDN nodes, so at least at those two points, “fixed” wasn’t complete.

The publisher saying it posted notices on its community and on X also makes the NGA post’s claim, that the launcher notice came from a well-meaning person via insightjs.org, harder to judge. Which notice players actually saw in the launcher, I can’t confirm.

The NGA post ends by cursing Koreans. The modified files sit on playerinfinite.com, a domain of the publisher Level Infinite, and MotherSphere records it as hosted on Tencent Cloud’s COS. There’s currently nothing to show what role, if any, developer SHIFT UP played here. If anyone has to answer first, it’s whoever runs that CDN.

My take

What bothers me most about this is the launcher’s design.

A game launcher loading announcements and news as web pages is common. But letting those pages call native download-and-execute functions turns “can edit one JS file on the CDN” directly into “can run arbitrary programs on every player PC with the launcher open.” That’s the breach WormW points to; the CDN tampering was only the starting point.

The attacker here was patient. The files were modified hours after the domain was registered, and for nearly four weeks after that the public record shows only certificate requests and server moves. The first reported agent start was October 23, and even then not every launch got it. My guess is that this was meant to keep the odds of discovery low, but nothing in the reports shows the attacker’s intent.

My own call: if you write code on your PC and play the PC version of NIKKE on the same machine, it’s worth spending an evening rotating your AI tool and cloud keys even if you can’t find k2f_chan. Rotation costs tens of minutes; a key used to run up a bill could cost thousands of dollars.

Level Infinite says follow-up measures will come in a separate notice. I’d like that notice to answer at least four questions. How did CDN write access leak? Besides these four files, were any other resources modified in the same window? Roughly how many players were affected? When will it force a purge of every CDN node and every player-side cache?

What would change my mind? If an official investigation shows only a small fraction of players actually received the agent, the risk assessment can come down; neither report currently has any estimate of how many people were affected. If the launcher is updated to remove web content’s ability to call the native download function, I’d consider the problem fixed at the root. Conversely, if other Level Infinite game launchers turn out to load the same modified shared files (aegis-fix.min.js and vue-bucket.min.js both sit under comm/assets/lib/, which by path looks shared), the impact reaches beyond NIKKE; neither report has confirmed this so far.

If you want more incident analysis like this, this site has previously covered the two php2shell PHP remote code execution flaws in depth, and how one person with hundreds of AI agents broke into PaperCut.