NIKKE PC launcher: tampered CDN scripts deliver K2F backdoor and credential theft
Severity: high · Patch status: partial · Since 2026-11-04
Level Infinite, the publisher of NIKKE, posted on X that it had identified an issue indicating that the PC launcher's script files may have been tampered with by a third party, that client fixes and an update were implemented on 2026-11-04 at about 02:30 (UTC+9), and that the scope of impact is still under investigation. The technical chain comes from one independent researcher (MotherSphere) plus BleepingComputer's own analysis of two script files: four JavaScript files on the publisher's CDN were modified on 2026-09-27 around 06:41 GMT, and each one loaded a script from insightjs[.]com, falling back to insightjs[.]org. That script fetched a LuaJIT payload (insight.bundle) that installed K2F, a Lua remote-control agent able to run commands, read and download files, take screenshots, and harvest NIKKE account credentials and browser data. A Windows DLL that K2F can install reportedly steals crypto-wallet data (MetaMask, Phantom, Coinbase Wallet), but whether it was deployed is not confirmed. Per the researcher, three of the files were replaced on 2026-11-03 and the fourth stayed modified on some CDN servers until 2026-11-04. No affected-user count and no attribution has been published. Players should search Launcher/intlservice/debug.log for the string 'k2fchan registered'; if it is present, run a full scan and, if compromise is confirmed, reinstall Windows and rotate passwords and wallet keys from a clean device.
What to do
- Run a full antivirus scan; check Launcher/intl_service/debug.log for 'k2f_chan' to detect the K2F agent
- If compromise is confirmed, reinstall Windows and change all passwords, wallet recovery phrases and other credentials from a clean device
- Update the NIKKE PC client/launcher to the fixed version issued 2026-11-04 and verify launcher scripts are clean
- Assume browser-stored credentials and crypto wallet extensions may be exposed; move wallet keys off affected machines
- Monitor publisher notices for scope-of-impact updates
Fixed versions
- Client update 2026-11-04 ~02:30 UTC+9
Sources
All live incidents on Threat Watch
