Top story
A compromise of the NIKKE PC launcher was reported. Between September 27 and November 3, 2026, two official JavaScript files hosted on Level Infinite’s CDN were altered so the launcher could download and run a remote-control payload. The report says the payload became active around November 2–3 and could allow an attacker to execute commands, read files, capture screenshots, and steal credentials from affected systems.
Immediate status
Level Infinite reportedly replaced both tampered CDN files on November 3, 2026, at 17:04 and 17:21 GMT. The updated files were described as no longer containing the loader code. However, the fix does not automatically clean machines that were already affected, and cached copies of the modified files may remain in the launcher. Users were advised not to open the launcher until the fix is confirmed and to clear the cache first.
Who should be concerned
The reported risk affects anyone who launched the NIKKE PC client during the active window on Windows or on Linux and Steam Deck through Proton. It also includes users whose launcher still loads altered files from cache. The report emphasizes that Proton does not make the system immune, because remote commands can access mapped drives and environment variables available to the Linux user.
What the agent could do
The payload was described as a full remote-access tool rather than a narrow data stealer. While the launcher was running, an operator could execute arbitrary commands, browse the file system, download files, capture screenshots, and harvest credentials from browsers, Windows Credential Manager, SSH configurations, cloud tools, developer environments, and crypto wallet extensions.
On Windows, the agent could also install persistence through a Chrome-related DLL hijack. Because the attacker had broad command execution capability, the report treats an infected machine as potentially compromised to the level of the affected user account.
Recommended response
The report recommends the following steps:
- Do not open the NIKKE PC launcher until Level Infinite confirms the issue is resolved.
- Clear the launcher cache before using it again, particularly the
tbs_cachefolder in the launcher data directory. - Block the reported domains and IP address in hosts, router, or firewall settings, while recognizing that the attacker may switch infrastructure.
- If infection is indicated, close the launcher or disconnect the machine from the network to cut remote access.
- On Windows, remove the Chrome persistence folder and the malicious HKCU registry CLSID entry if present.
- Treat passwords, sessions, API tokens, SSH keys, cloud credentials, and crypto wallets as exposed, then rotate or move them from a clean device.
- Consider reinstalling the operating system on affected machines, especially where sensitive credentials or elevated access were present.
Signs to check
Users can inspect the launcher debug log for the marker k2f_chan. The report says its presence indicates the agent ran on the machine. It also references log entries associated with the downloaded bundle and agent startup, while noting that logs can be overwritten on each launch and may not preserve earlier activity.
Technical outline
The compromise reportedly began when code was appended to two legitimate launcher JavaScript files served from Level Infinite’s CDN. The inserted code loaded an external loader, which fetched a LuaJIT bytecode payload. The payload was obfuscated and used a custom channel to receive commands and return output. The infrastructure involved an Iceland-hosted IP address and a domain registered around the same time as the CDN files were altered.
The report says the payload was analyzed statically and never executed during the investigation. It was checked against downloaded files, launcher logs, caches, and live servers.
Key indicators from the report
- Modified CDN files:
aegis-fix.min.jsandimages.7fec4c32.js - External loader domains:
insightjs.comand fallbackinsightjs.org - Payload URL:
analytics.insightjs.com/comm/assets/insight.bundle - Reported IP:
89.127.233.127 - Log marker:
k2f_chan
Open questions
As of the report’s last update, several questions remained: how the attacker obtained write access to Level Infinite’s CDN, whether cached copies still expose users, whether the attacker can use new domains, and whether Level Infinite had issued a broader public statement. The report says the old CDN files were replaced, but the attacker-controlled payload was still online when checked.
Comments
Leave a comment