Bitdefender links credential theft campaign to hijacked NIKKE PC launcher

Bitdefender Labs said its investigation found a credential theft campaign that pushed a full-featured information stealer to players through the NIKKE game launcher, with detections beginning Oct. 30, 2026.

Shift Up developed the sci-fi RPG shooter Goddess of Victory: NIKKE, and Level Infinite published it for PC, iOS, and Android. The publisher reported worldwide downloads exceeding 45 million since launch, with Google Play alone accounting for 10 million.

The attackers abused the launcher’s server-pushed task channel, known internally as the CGI task manager, to make clients pull and run the payload at runtime. Bitdefender said the game distribution received no binary patch, no vulnerability exploit, and no malicious file; the intruders relied on legitimate launcher functions instead. On login, the launcher queries its backend for tasks, and the backend supplies URLs at runtime, so the same build can be told to download from any address.

Bitdefender identified the payload as k2f-agent, a Lua-based information stealer delivered as obfuscated LuaJIT bytecode in a normal log file. A 205,135-byte response was written to tinyget.20261103-030255-271.log in the launcher log folder; the file held LuaJIT 2.1 bytecode marked by the \x1bLJ magic bytes.

The launcher queued a download 1.6 seconds after the task response arrived, pulling the bundle from https://analytics.insightjs[.]com/comm/assets/insight.bundle. The address analytics.insightjs[.]com pointed to during the attack was 89.127.233.127, an Icelandic server. Registration records show insightjs[.]com dates to Sept. 27, 2026, about five weeks before the attack. Bitdefender said the name likely resembles the open-source library insight.js, though it sees no evidence the library or its maintainers participated.

The bundle registered k2f_chan on the launcher’s JavaScript-to-native bridge, opening an attacker command channel within the trusted process. Every k2f-related string and artifact lived in the launcher’s heap memory, though no such code appeared in any module on disk.

The scrambled payload uses a 1,790-entry encrypted string table with custom base64 and base85 decoders, and carries build tag K2F_LUA_BUILD = “722b99d8d0e9”. The source code covers 46 modules, 18 operator commands, 13 Windows backends, seven collection stages, and a data-driven dispatcher. Download, collection, exfiltration, and cleanup finished in under 10 minutes, leaving almost no malicious artifacts.

BrowserScan scans Chrome, Edge, and Opera profile folders, including recovery, cached-data, and safety-list directories, to collect stored login databases and cookie files. Bitdefender notes the build also supports Firefox and Gecko profiles.

Staged databases land in the temp folder under names such as %TEMP%\k2f-bcreds-<unix-time>-<random>.db, with possible sidecar files bearing .db-wal, .db-shm, or .db-journal extensions. Against staged databases, the stealer runs SELECT origin_url, username_value, password_value FROM logins. The tool decrypts Classic v10 AES-256-GCM blobs through DPAPI. It uses a Local State key and supports Chrome’s App-Bound Encryption starting with Chrome 127.

The server decides cookie collection per victim, and the observed run had collect_cookies set to false.

The operation reads LevelDB storage for browser extension vaults identified by ID, such as MetaMask, Phantom, Coinbase Wallet, Keplr, and TronLink. Bitdefender says an attacker with a MetaMask .ldb vault and the Local State primary key can recover the seed phrase offline to drain the wallet.

The run retrieved NuGet.Config from %APPDATA%\NuGet\. It also pulled the PowerShell profile from %USERPROFILE%\Documents\WindowsPowerShell\. The keyscan modules existed but went unused; they can collect SSH private keys such as PuTTY .ppk files, GPG keyrings, Git credentials, Kubernetes configs, environment variables, and shell history. The payload download path is separate from the exfiltration path, and stolen data moves through the launcher’s ordinary telemetry system.

The publisher’s timeline says hijackers took over the game service domain on Sept. 27, 2026, and altered the launcher script. That timeline says malicious program distribution began on Oct. 30, 2026. Researcher MotherSphere said signs showed the remote-control agent active by Oct. 23, 2026, conflicting with the publisher’s stated Oct. 30 distribution start.

Management advised anyone who launched the Windows PC client from Sept. 27 at 15:41 UTC+9 onward to check for compromise. Level Infinite said the incident affects only the PC launcher. Mobile players are unaffected. The number of compromised PCs and the full scope of data theft remain unknown.

Level Infinite said on X that third parties may have altered the PC launcher script files and released a fix on Nov. 4 at 02:30 UTC+9. The developers apologized for not providing a secure service and said in-game compensation was prepared for all Commanders.

Players should run an antivirus scan and reinstall Windows if compromised. They should update passwords and credentials using a clean device. Users should delete %APPDATA%\nikke_launcher\tbs_cache before reopening the launcher because it may still contain modified files the launcher would reload. Level Infinite asks affected players to contact support for account or financial problems.

MotherSphere reported alterations to four JavaScript files on Level Infinite’s CDN on Sept. 27, 2026. The malicious JavaScript pulled extra code from insightjs[.]com and insightjs[.]org. BleepingComputer examined two of the changed JavaScript files.

It confirmed an obfuscated loader meant to pull code from those domains, using the second domain as backup. The payload named insight.bundle installed K2F, a remote-access agent.

It enabled remote commands, local file access, downloads, screenshots, credential theft, and browser data collection. An extra command installed platform_experience_helper.dll, a malicious Windows DLL. It could remain active after the launcher closed.

VirusTotal DLL strings showed the malware can intercept wallet data, including recovery phrases and private keys, from extensions such as MetaMask, Phantom, and Coinbase Wallet. It remains unknown whether anyone deployed the DLL or stole any cryptocurrency.

Level Infinite replaced three affected JavaScript files with clean versions on Nov. 3, according to the researcher. At 22:26 GMT, a tampered copy of the fourth remained available.

The backup domain insightjs[.]org displays a security warning in four languages: English, Chinese, Japanese, and Korean. It urges players to close the launcher and not open the PC client until the publisher confirms a fix; control of the domain is unclear. Hosting in Iceland shut down the malicious server, so the delivery domain cannot be reached and the attack chain cannot fetch the bundle; normal launcher operation continues unaffected.

Bitdefender Advanced Threat Defense stopped a process reading browser credential stores and shut down the launcher on affected machines. Players lost access to the game, but the intervention blocked the data theft.

The string k2f_chan appearing in Launcher\intl_service\debug.log indicates the malicious Lua agent executed. Users saw a Reddit post as Bitdefender flagged the launcher. The poster doubted a false positive or real infection. Bitdefender confirmed the launcher was stealing credentials.

On Nov. 10, 2026, Bitdefender told the developer and publisher it planned to publish the analysis, but received no response by publication. Bitdefender said it does not know who operates the campaign or how they reached the launcher’s task channel. Because the bundle lacks game-specific logic, attackers could abuse any application using the same task channel and JavaScript-to-native bridge similarly.

MotherSphere said the malware could target Linux and Steam Deck systems. Bitdefender said it sees no sign that the open-source library insight.js or its maintainers took part.