Nikke PC Launcher Compromise

한국어 번역 (Korean translation): nikke-pc-launcher-compromise_ko.md

From 2026-09-27, four official JavaScript files on Level Infinite's CDN contained attacker code. The NIKKE PC launcher loads these files. From Oct 23 at the latest, opening the launcher could install a remote-control agent: while the launcher was open, the attacker could run any command on your machine, read any file and take screenshots.

Update, 2026-11-03 22:40 GMT: three of the files were replaced on Nov 3 at 17:04, 17:13 and 17:21 GMT. The fourth, FeedList.feb647c9.js, was cleaned at the origin on Oct 28, but two CDN servers still delivered the modified copy at 22:26 GMT. The attacker's server no longer answered at 18:31 GMT. None of this undoes anything on machines that were already infected, and the old files may still be in your launcher's cache. Do not open the NIKKE PC launcher until Level Infinite confirms the fix, and clear its cache before you do.

This report comes from one infected machine, plus findings from other victims posted in the comments. The payload was analyzed statically and never executed. Everything below was checked against the downloaded files, the launcher's logs and caches, the decompiled payload and the live servers. Findings from the comments are marked as reported when they could not be checked here.

Last updated: 2026-11-04, 02:00 GMT. Added in this update: a DNS log can miss the agent's lookups when the PC also has a second DNS server (luminesce01); the earliest recorded insightjs.com lookup, Oct 5 07:09 GMT (luminesce01); an older build still served on Nov 1 at 18:03 (axm2). Earlier at 01:10 GMT: a fifth payload build, Nov 3 12:31:04 (vvs); the earliest reported agent start is now Oct 23 16:40 GMT (zbeosf). Earlier at 00:45 GMT, corrected: creds decrypts the NIKKE login that the launcher saved, not Windows Credential Manager (keyscan reads Credential Manager, for developer-tool entries only); wallet_files only reads Chrome's profiles; Korean translation added. Earlier at 00:30 GMT: 1984 ehf told a reporter that it shut down 89.127.233.127 (seth12619); how to measure what was sent with SRUM (rnikontas, asyadayo); what the agent does on its own and what the server decides. Earlier at 22:40 GMT: the Chrome DLL can be installed without Chrome (checked in the code); a second attacker IP, 89.126.250.172, used until about Oct 21 (D-Maledicte); a fourth payload build, Nov 2 17:48:47 (malevolenttortoise, Iwassoobsessedwith); all agent traffic goes through the launcher's embedded browser; startup already in progress is not a reliable sign either way. Earlier at 20:40 GMT: a fourth modified file, vue-bucket.min.js (mikansubre); agent starts from Oct 24, not Nov 1 (malevolenttortoise, CuauhtliHC); at least three builds of the payload (neutralnikke, confirmed here); what the Chrome DLL does and why it must be removed after a restart (cheejordan). Earlier in the day: a third modified file, FeedList.feb647c9.js (found by RichyRich515 and Enerccio in the comments, confirmed here); the payload served earlier than Nov 2-3; debug.log is appended to, not overwritten on each launch; collect_cookies: false does not mean cookies were safe. Earlier corrections: the PlatformExperienceHelper folder itself is normal Chrome (only a 64-hex subfolder with the DLL is malicious), and onominan.tmp is not a malware marker.

Summary

Check if you are infected

What to do

What the attacker can do on an infected machine

Linux and Steam Deck (Proton)

Technical details

Infrastructure

Indicators of compromise

For Level Infinite

Summary

Entry point Four official files on Level Infinite's CDN (playerinfinite.com, Tencent COS), modified on 2026-09-27

Status aegis-fix.min.js, vue-bucket.min.js and images.7fec4c32.js replaced on Nov 3 at 17:04, 17:13 and 17:21 GMT. FeedList.feb647c9.js clean at the origin since Oct 28, but still modified on two CDN servers at 22:26 GMT

Still open How the attacker got write access to the CDN; the CDN servers that still deliver the modified FeedList.feb647c9.js; old files in launcher caches; no official statement yet

Who is at risk Anyone who opened the NIKKE PC launcher from Oct 23 (at the latest) until the fix, on Windows or on Linux / Steam Deck through Proton, and anyone whose launcher still uses the modified files from its cache or from a stale CDN server

Payload active since Oct 23, 2026 at the latest, and only on some launches (one machine got it on 3 of about 19 launches). The earliest agent start reported in the comments is Oct 23 at 16:40 GMT (zbeosf), about an hour after the Oct 23 15:37 certificate. The loader has been in place since Sep 27

What it is A remote-control agent: command execution, file access, screenshots, theft of passwords, browser cookies, tokens, SSH keys and crypto wallets

Persistence On Windows, a DLL registered in the user's registry so that Chrome loads it, and it keeps running after the launcher is closed. Installing it does not need Chrome. It reads passwords typed in web pages and wallet recovery phrases (reported)

Check if you are infected

Open your NIKKE install folder.

Open Launcher/intl_service/debug.log in a text editor.

Search for k2f_chan.

If you find it, the agent ran on your machine, even when the adopted or resuming line after it is missing (that line comes from l.js once the server answers). An infected log looks like this:

"lua downloaded to log\tinyget\tinyget.<timestamp>.log" (log\tinyget\k2f.lua on early runs) "k2f_chan registered" "adopted <uuid>" "agent started as <your computer name>"

Launcher/log/tinyget/tinyget.*.log also records the download of https://analytics.insightjs.com/comm/assets/insight.bundle. Some infected launches also log startup already in progress just before the download, but others do not, so search for k2f_chan registered.

Two quick checks outside debug.log: the loader entries in %APPDATA%\nikke_launcher\tbs_cache\Code Cache\js\ have the same file names on every machine (dd65fa4d61079e7e_0 aegis, ce2fd3f1007a9fe9_0 images, 1416c638b3830103_0 feedlist, fd520c7c0f65c2d7_0 vue), and in DNS or router logs a lookup of insightjs.com means the loader ran, while a lookup of analytics.insightjs.com most likely means the agent stage was reached. A DNS log only sees the lookups sent to it: on one infected PC that also used an IPv6 DNS server from the router, the Pi-hole log had no analytics.insightjs.com at all (reported), so a log without it does not rule out the agent.

The launcher appends to debug.log: on the analyzed machine it held all 9 launches from Oct 29 to Nov 3. It is gone if the NIKKE folder was deleted or reinstalled. FETCH_LIST suc success lines come from the normal FeedList module and appear on clean launches too, so they are not a sign.

The agent also saves its state in the launcher's Local Storage, outside the NIKKE folder: search the files in %APPDATA%\nikke_launcher\tbs_cache\Local Storage\leveldb\ for k2f.agent. On Windows, also check for the persistence files listed in What to do.

Everyone

Do not open the NIKKE PC launcher until Level Infinite confirms the fix.

Before you open it again, delete the launcher's cache folder %APPDATA%\nikke_launcher\tbs_cache (inside your prefix on Proton). It may still hold the modified files from before the fix.

Block these in your hosts file, router or firewall: insightjs.com analytics.insightjs.com insightjs.org 89.127.233.127 89.126.250.172

This only stops the current server. How the attacker got write access to Level Infinite's CDN is not known yet, so they may be able to try again with a new domain.

If you are infected

Close the launcher, or disconnect from the internet, so the attacker loses access.

On Windows, remove the persistence:

First delete HKCU\Software\Classes\CLSID{E77CC89B-7401-4C04-8CED-149DB35ADD04} if it exists. The same CLSID also exists under HKLM on every Windows install, pointing to wpc.dll (WindowsParentalControls). Leave that one. Only the HKCU copy is malicious.

Restart Windows. The DLL stays locked while it is loaded, even with every Chrome window closed (reported).

If the key exists with an empty default value, delete it anyway: that is what the agent's own chrome_uninstall leaves behind.

Then open %LOCALAPPDATA%\Google\Chrome\User Data\PlatformExperienceHelper\ and delete any subfolder whose name is a 64-character hex string and that holds platform_experience_helper.dll. Do not delete the whole folder: Chrome creates PlatformExperienceHelper itself for its own platform_experience_helper.exe and an empty LoadFeatures file, so the folder on its own is normal.

Microsoft Defender Offline did not detect the DLL on one machine (signatures 1.463.110.0), so a clean antivirus scan does not mean it is gone.

Reinstalling Windows is the safest option, because the attacker could run any command while the agent was active.

From a clean device, change your passwords: NIKKE / Level Infinite first, then email, Discord, banking and every password saved in a browser. Turn on two-factor authentication.

Log out of all sessions (Discord, Google, Steam, GitHub and others). The agent can steal browser cookies, which work without your password.

Revoke and regenerate API tokens, SSH keys and any developer credentials (GitHub, npm, AWS, OpenAI, Anthropic and others).

Move crypto wallet funds to a new wallet with a new seed phrase.

What the attacker can do on an infected machine

The agent is a remote-access tool controlled by the operator. It does not only run a fixed stealing routine. While the launcher is open, the operator can send these commands:

exec alone means the operator can do anything your user account can do: install other malware, read any document or change files. The other commands are shortcuts.

The Lua agent does nothing on its own. It registers k2f_chan with the launcher's comm_center and then only answers open, read, write, ping and close requests. Every command comes from the server through l.js. Victim data shows that the first commands arrive within seconds of the agent starting: one Chrome DLL was written 3 seconds after the start, and the launcher's embedded browser sent about 0.9 MB and 16.6 MB in the hour of the start on two machines (reported, SRUM). So a first collection seems to run automatically on every new agent, and missing temp files or a collect_cookies: false config do not mean nothing was taken. whoami reports the launcher's integrity level and whether it runs elevated; a victim reports that the launcher asks for administrator rights by default, and an elevated launcher lets browserscan use the SYSTEM token for Chrome and Edge app-bound encryption.

To see how much left a Windows PC: SRUM (C:\Windows\System32\sru\SRUDB.dat) keeps bytes sent per program per hour. Open it as administrator with NirSoft NetworkUsageView, or copy it and parse it with SrumECmd, then compare the hours of the agent starts with the usual values for tbs_browser.exe. All agent traffic goes out under that process, not under the game.

Only exec starts new programs (it is the only module that loads win32.exec and CreateProcessW). The other commands run inside the launcher process through LuaJIT FFI, so Prefetch and process-creation logs cannot show them. The agent stays active as long as the launcher is open, and the launcher often stays open in the notification area while the game runs: one reported agent checked in 22 times over 9 hours.

None of these commands leaves an entry in the launcher logs. A victim cannot tell from the logs which commands were run, so assume the worst.

The automatic scans look for Windows paths, so they find little in a Proton prefix. On the machine analyzed here, the only target present inside the prefix was the NIKKE launcher data.

The remote commands are a different matter. Wine maps your Linux home folder and / as drive letters (Z: at least). It also passes your environment variables to the game, and the agent reads all of them. With exec, ls, cat and download, the operator can