The NIKKE PC Launcher Served Tampered Scripts From the Publisher's Own CDN. The Loader Calls insightjs.com, and the Payload Is a Remote-Access Agent Called K2F.
If you installed the PC launcher for Goddess of Victory: NIKKE and opened it recently, treat the machine as possibly compromised until you have checked. Look in the install directory for Launcher/intl_service/debug.log and search it for the string k2f_chan registered. If it is there, the attacker's agent ran. The publisher, Level Infinite, says the launcher's script files "may have been tampered with by a third party" and says fixes went out November 4.
What was tampered with
Per BleepingComputer's report of researcher MotherSphere's GitHub analysis, four JavaScript files on Level Infinite's official content delivery network were modified, on September 27, 2026 by the researcher's account. The malicious code was hidden inside legitimate JavaScript and pulled more code from attacker servers each time the launcher opened. The game has more than 45 million downloads since its 2022 launch, and Google Play alone reports 10 million. The number of affected PC players has not been given.
The chain
An obfuscated loader retrieves code from insightjs[.]com, and falls back to insightjs[.]org if the first is unavailable. It abuses the launcher's native functionality to run a malicious LuaJIT payload named insight.bundle. That payload installs a remote-access agent called K2F. It can run commands, browse and download files, take screenshots, and collect NIKKE credentials and browser data.
A K2F command can also install a Windows DLL, platform_experience_helper.dll, that stays active after the launcher closes. BleepingComputer's analysis of a DLL sample found code to steal crypto wallet data from MetaMask, Phantom, Coinbase Wallet and others, including recovery phrases and private keys. It is not known whether that component was deployed or whether any cryptocurrency was stolen.
How to check
The one host indicator in the report is the string k2f_chan registered in Launcher/intl_service/debug.log inside the NIKKE install directory. It shows the Lua agent ran. It does not confirm the DLL loaded, so a missing string is not proof the machine was spared the DLL, and the report does not say how to check for the DLL beyond its name.
The two domains are the network indicators. Block them and look for lookups of either in your DNS logs. The report notes insightjs[.]org now shows a warning in English, Chinese, Japanese and Korean telling players to close the launcher, and that this is not an official publisher message and the domain's current controller is unclear. Block it anyway.
What the publisher says
Level Infinite says client fixes and an update were implemented November 4 at about 02:30 (UTC+9), that it is investigating the scope, and that it will give details in a separate notice. The researcher says three of the four files were replaced with clean versions on November 3, but a tampered copy of the fourth was still being served as of 22:26 GMT. BleepingComputer, which independently examined two of the modified files and confirmed the obfuscated loader, had no reply from Level Infinite by publication.
If you are affected
Run a full scan with updated antivirus. If the debug.log string is present, the report advises reinstalling Windows, and changing passwords and other credentials from a clean device. If crypto wallets were on the machine, move funds to a new wallet created on a clean device. That last step is our inference from the wallet-theft code, not the report's advice.
What we hold
We ingested the two domains into the feed under the source manual-batch-nikke-launcher-2026-11, at confidence 85, each confirmed by reading it back by primary key. They are attributed to the K2F family, with no actor named, because none is. The credit is MotherSphere's, via BleepingComputer. It is not our discovery, and we are not claiming a lead. The report prints only a truncated hash for the DLL sample, so we did not ingest a hash.
Limits
One secondary report of one researcher's analysis. We did not read the GitHub write-up, Level Infinite's statement, or the malware itself.
Five percent of this is wrong somewhere. It always is.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.