#level-infinite

November 5, 2026

NIKKE's PC launcher was backdoored through its own CDN. Four JavaScript files on Level Infinite's CDN were modified on September 27 to pull obfuscated code from insightjs[.]com / insightjs[.]org; the loader abused launcher functionality to run a LuaJIT payload installing the K2F remote-access agent (command execution, file browsing, screenshots, account and browser credential theft) plus an optional platform_experience_helper.dll that survives launcher close. Strings in a VirusTotal sample show crypto wallet extension theft (MetaMask, Phantom, Coinbase Wallet). Client fix shipped November 4 at 02:30 KST (BleepingComputer, IOCs). · Threat Activity