Affected Systems
Goddess of Victory: NIKKE PC launcher (Windows). Malicious JavaScript injected into launcher scripts on September 27, 2026, served via Level Infinite's official CDN. Over 45 million downloads globally, with active compromise window from late September through November 3-4, 2026.
Exploitation Status
Active exploitation confirmed. Malicious scripts were served from official CDN starting September 27, 2026. Attackers deployed K2F backdoor and platform_experience_helper.dll malware. One compromised JavaScript file reportedly still served to users as of November 3, 22:26 GMT, after initial remediation.
Business Impact
Players who launched the NIKKE PC client between late September and November 4, 2026 may have been infected with remote access malware. The K2F backdoor enabled command execution, file exfiltration, screenshot capture, and credential theft. Additional DLL component targeted cryptocurrency wallets (MetaMask, Phantom, Coinbase Wallet) to steal recovery phrases and private keys. Unknown number of systems compromised; scope under investigation by vendor. No CVE assigned. Organizations with employees playing games on corporate devices face potential lateral movement risk.
Urgency
🔴 Immediate
Recommended Actions
- Identify systems with NIKKE PC launcher installed; check Launcher/intl_service/debug.log for string 'k2f_chan' indicating malicious Lua agent execution
- Run full antivirus scans on all potentially affected Windows systems; consider reimaging confirmed compromised endpoints
- Force password resets for users who launched NIKKE PC client between September 27 and November 4, 2026, prioritizing domain credentials and sensitive accounts
- Monitor for unauthorized access to cryptocurrency wallets; advise affected users to rotate wallet recovery phrases and private keys from clean devices
- Block network indicators: insightjs[.]com and insightjs[.]org at perimeter firewalls and DNS; search proxy logs for connections to these domains since late September