November 5, 2026
- NIKKE's PC launcher was backdoored through its own CDN. Four JavaScript files on Level Infinite's CDN were modified on September 27 to pull obfuscated code from
insightjs[.]com/insightjs[.]org; the loader abused launcher functionality to run a LuaJIT payload installing the K2F remote-access agent (command execution, file browsing, screenshots, account and browser credential theft) plus an optionalplatform_experience_helper.dllthat survives launcher close. Strings in a VirusTotal sample show crypto wallet extension theft (MetaMask, Phantom, Coinbase Wallet). Client fix shipped November 4 at 02:30 KST (BleepingComputer, IOCs). · Threat Activity