The NIKKE PC Launcher Was Poisoned on September 27 and the Fix Came 38 Days Later

A player on the Chinese gaming forum NGA searched a log file on November 3 and found six lines carrying k2f_chan, plus one line recording that the agent had been adopted. The player’s debug.log had grown to more than 800 megabytes, the malicious DLL and its registry entry were both present, and the player asked the thread, in translation, “I’m scared. Is there any way to deal with it?” The thread had opened on November 3. The publisher’s first public notice came after that, and by then players had already written the check and listed the files. They were already arguing about what a clean scan was worth.

The string means the remote-control agent ran. MotherSphere, an independent researcher, traced the chain back to four JavaScript files on Level Infinite’s content delivery network. The researcher’s GitHub gist became the incident’s main record. That network sends launcher files to players from regional servers. Every time the NIKKE PC launcher opened, it fetched those files and ran them. The tampered copies carried a short loader, hidden inside ordinary code, that called out to a server the attacker controlled and pulled down a second file, insight.bundle, through the launcher’s own download function. That file installed K2F, a LuaJIT agent that waited for commands while the launcher stayed open. On the machine MotherSphere analyzed, the agent arrived on three of about nineteen launches, which is why opening the launcher and being infected were never the same thing.

The four files were aegis-fix.min.js, vue-bucket.min.js, images.7fec4c32.js and FeedList.feb647c9.js. Their Last-Modified stamps fall inside twenty-three seconds on September 27, starting at 06:41:40 GMT. The added code hid its destination in a list of numbers that the launcher decoded into a web address. If the first address failed, the code tried the same name with a different ending, .org instead of .com. In FeedList.feb647c9.js the added 708 bytes sat just before the file’s final export statement, where a check that compared only the ends of files would miss them. Two of the files lived in a shared library folder with no mention of NIKKE in the path, and the other two lived in folders named for the launcher.

Loader lookups that players reported came first on September 30, and the earliest agent start anyone reported was October 23, almost a month after the files changed. A second, independent analysis found the same shape: WormW, a researcher writing under that name, counted several builds of the payload. They were uploaded across late October and early November. An older, smaller build from October 23 carried fourteen commands instead of nineteen. The game’s fourth-anniversary update went live worldwide on October 29, and the reported agent starts cluster in the days after it, from October 30 to November 3. The update did not create the poison, since the agent predates it, but it sent players to open the launcher in the middle of the window. The agent checked in about every thirty minutes, give or take six. One reported agent checked in twenty-two times over nine hours. Players often leave the launcher running in the system tray while they play.

Level Infinite replaced three of the files on November 3, between 17:04 and 17:23 GMT. The fourth file had been cleaned at the origin server on October 28, but two regional servers kept handing out the poisoned copy that evening, and a third was still doing it after midnight. All four servers the researcher checked took the clean copy between 03:12 and 03:21 GMT on November 4, and a check at 11:20 GMT found all four files clean. That did not finish the job on players’ own machines, because the launcher keeps a cache of the files it fetched. The cached copies were stored compressed, so a plain text search finds nothing in them. The cached copy of one file carried instructions to keep it for ninety days. FeedList kept the same web address in the rebuilt launcher. MotherSphere told players to delete the cache folder before opening the launcher again. The checks should come first, or the folder should be copied, since it holds traces of whether the agent ran.

The agent answered commands from its server while the launcher stayed open. The one that mattered most was exec, which runs any program and returns the output, so anything the player’s account could do, the operator could do. The rest were shortcuts: browsing folders and downloading files, screenshots of every monitor, the saved NIKKE login, saved browser passwords and cookies, and a scan of 264 known credential and configuration paths. That list is where this incident stops looking like a games story. SSH keys and GPG data were on the list. Cloud credentials followed, for Amazon, Google and Azure and eighteen more providers, with tokens for GitHub, npm, Stripe and Twilio. Shell histories and project folders scanned for .env files were listed too, with sign-in files for Claude Code, Codex, the Gemini command-line tool, Cursor and Windsurf. It also includes data from twenty-eight cryptocurrency wallet extensions in Chrome. WormW’s separate decode counted about 1,790 target paths in total, using a wider count that includes subpaths. A setting in the agent’s saved configuration said cookies should not be collected, but saved passwords were read anyway, and the file commands could copy a cookie file whole. The launcher’s logs never recorded which commands were sent, so no player can read them back and learn what, if anything, was taken.

On Windows, the agent could install a second piece that outlived the launcher. The command was chrome_install. It wrote a DLL into Chrome’s user-data folder under a 64-character folder name and registered it so Chrome would load it. The code kept running after the launcher closed. The DLL was built separately for each victim, with its own folder name and token, so no single file hash identifies every copy. Microsoft Defender Offline did not find the DLL on one machine the researcher checked. Removing it means deleting the registry entry first, restarting Windows, and then deleting only the folder that holds the DLL, because the folder around it belongs to Chrome. Players on Linux and Steam Deck, running the launcher through Proton, were not protected by that either. Wine maps the Linux home folder as a drive and passes environment variables through. Remote commands could read SSH keys, browser profiles and configuration files there, so every secret in the home folder had to be treated as exposed. The Chrome persistence does not apply on Linux, but the agent’s other commands do.

The publisher’s first notice was posted on November 4. It said the launcher’s script files may have been tampered with by a third party and that fixes had gone out. It promised a separate notice with follow-up measures. It named no files, described no payload and gave players no steps, a gap MotherSphere’s summary states plainly. The follow-up came on November 5, with an apology. Level Infinite apologized for a program that threatened players’ safety. In the operations team’s words, “It is entirely unacceptable that an official program launched to enjoy the game could instead threaten the safety of users.” The company said the domain at the centre of the attack had been hijacked, and that malicious software was distributed from October 30. The researchers’ record says something else on both points. WormW’s analysis says the domain was re-registered that September morning after about five years dormant, and a server was answering hours before the files changed. Players reported the agent running a week before October 30. Level Infinite also said a new feature in the official PC client now detects and removes the malware automatically. In-game compensation is being prepared. Players can report gameplay damage, compromised outside accounts and secondary financial losses through customer support.

One player on NGA found only the single log line. The player asked, in translation, “I only found ‘k2f_chan registered’ — does that count as being compromised?” Another, who found six of the lines and the DLL and registry entry with them, asked, in translation, “I’m scared. Is there any way to deal with it?” A third had both log lines and no DLL, and a full-disk scan that found nothing, and wanted to know what that meant. The answers matter because the checks are not symmetrical. Finding the string means the agent ran. Not finding it proves nothing if the logs were deleted or the game was reinstalled, and a clean scan doesn’t clear a machine on its own. Level Infinite’s November 5 guide now tells players to do what the players were already doing. Search the same log file for the same string. Delete the same registry entry and DLL folder, and delete the launcher’s cache. From a clean device, or after the check, players should change passwords and log out of every session. API tokens and SSH keys should be revoked. Cryptocurrency should move to a new wallet with a new seed phrase. Reinstalling Windows is the safest option where the agent ran, because the operator could have run any command.

How the attacker gained write access to the CDN remains unexplained in both accounts. Neither gives a number for how many players opened the launcher while the files were changed, or says whether any cryptocurrency was taken.