NIKKE PC Launcher Compromise: The "Hijacked" insightjs.com Domain and K2F RAT

TL;DR

---

The PC launcher for Goddess of Victory: NIKKE was compromised in late September, enabling the delivery of unauthorized programs. Publisher Level Infinite disclosed the timeline on November 5, stating that “the insightjs.com domain was maliciously hijacked by a third party.” To understand what actually happened with the domain, how it connects to the launcher tampering, and what traces were left on affected systems, this article synthesizes the official announcement and independent forensic reports. Information reflects details available as of November 5 at 22:00 JST.

Official Timeline and Disclosures

On November 5, Level Infinite published an incident overview alongside a guide for manual verification (PC Launcher Security Incident and Future Response, Manual Verification Method for PC Launcher Security). The timeline according to official statements is summarized below:

Date & Time (JST)	Official Explanation
Sep 27, 10:59	The domain insightjs.com, previously used in parts of game services, was hijacked by a third party
Sep 27, 15:41–15:42	Four official CDN script files downloaded by the launcher were tampered with, adding unauthorized code connecting to specific domains
Oct 30, 03:52	Distribution of malicious payloads to player PCs commenced via the tampered scripts
Nov 4, ~00:00	Abnormalities in launcher scripts detected; investigation and response initiated
Nov 4, 02:04–02:23	Three tampered script files replaced, halting further distribution (Phase 1)
Nov 4, 12:09	CDN cache invalidation completed for the remaining script file (Phase 2)
Nov 5, 08:00	Inspection and cleanup features deployed to the official PC client

A CDN (Content Delivery Network) replicates assets across edge servers worldwide to deliver content quickly; the launcher UI’s JavaScript files are served through this infrastructure. The affected scope includes any player who launched the Windows PC client at least once after September 27 at 15:41 JST. Players who exclusively play on mobile do not need to check.

The official distribution date conflicts with player telemetry. In comments on an analysis gist by independent researcher MotherSphere (MotherSphere Analysis Report), multiple players reported instances of the RAT executing as early as October 24 at 01:40 JST—six days before the official October 30 timestamp. The analysis report continues to receive updates based on victim submissions.

Registration History of the “Hijacked” insightjs.com

Domain names are leased for defined periods through domain registrars. When a domain expires without renewal, it eventually enters a grace period and is released back into the public pool, allowing anyone to register it. While the official announcement described the domain as having been “hijacked”—suggesting an active domain was seized—forensic registration records show that an expired domain was simply re-registered by a third party.

Item	Forensic Report Findings
Registration Date	September 27, 01:59 GMT (10:59 JST), matching the official timestamp
Registrar	PDR Ltd. (PublicDomainRegistry), registrant identity privacy-protected
Name Servers	Iceland-based host 1984 (ns0.1984.is, etc.)
Historical Usage	Public certificate transparency logs (crt.sh) record 19 Amazon-issued certificates for api.insightjs.com and cdn.insightjs.com between August 2019 and July 2022. The Wayback Machine holds 2017 snapshots showing an IIS server
Past Owners vs. Current Attacker	No evidence connecting historical users of the domain to the current threat actor

While Level Infinite stated that insightjs.com was “used for part of game services,” neither the official notices nor forensic analyses indicate whether Level Infinite or its affiliates operated the domain during the 2017–2022 window.

The interval between registration and file modification was approximately five hours. Aligning the domain records, certificate logs, and Wayback Machine archives chronologically reveals how rapidly events unfolded:

September 27 (JST)	Event
10:59	insightjs.com is re-registered
12:00	First SSL certificates issued for insightjs.com and www.insightjs.com
13:08	insightjs.com begins responding with HTTPS redirects (returning nginx 403 pages by 13:56)
15:41–15:42	Four JavaScript files on official CDNs are modified

Crucially, registering a domain alone does not grant access to official CDN storage. Researchers confirmed that the clean scripts prior to September 27 contained no references to insightjs.com. This was not an incident where an existing launcher dependency was broken by domain takeover; rather, the threat actor acquired the domain and compromised the CDN assets as two distinct actions.

Level Infinite noted that it is investigating networks and CDN pipelines to identify how assets were modified, leaving the initial compromise vector unresolved. The research report notes that until the mechanism used to obtain CDN write permissions is understood, threat actors could theoretically repeat the technique using different domains.

Tampered Files and the Download Chain

The following four CDN files were modified to inject script-loading logic pointing to insightjs.com (MotherSphere Analysis Report):

Official CDN File	Injected Target URL
sg-gpts.playerinfinite.com / aegis-fix.min.js	https://insightjs.com/l.js?f=aegis
na-webassets.playerinfinite.com / images.7fec4c32.js	https://insightjs.com/l.js?f=images
na-webassets.playerinfinite.com / FeedList.feb647c9.js	https://insightjs.com/l.js?f=feedlist
na-webassets.playerinfinite.com / vue-bucket.min.js	https://insightjs.com/l.js?f=vue

The injected logic encoded target URLs into numeric arrays to avoid trivial pattern matching. If insightjs.com failed to respond, the script fell back to insightjs.org. In FeedList.feb647c9.js, the 708-byte injection was placed immediately before the final export statement rather than at the end of the file, bypassing naive diffs that only check file tails.

When executed, l.js used the launcher’s built-in file download facility to retrieve https://analytics.insightjs.com/comm/assets/insight.bundle. This bundle is the core payload of the remote access tool (internally named K2F), compiled into LuaJIT bytecode. Because the launcher integrated a Lua runtime, the payload could execute without dropping an independent .exe binary. The launcher stored this payload inside Launcher\log\tinyget\ using a .log extension, executing and subsequently deleting it. Early variants observed around October 24 used the filename k2f.lua and lacked self-deletion logic, leaving persistent files on disk in some victim environments. Payload distribution was intermittent: in one analyzed environment, the bundle was delivered on only 3 out of 19 launcher boots.

flowchart TD
  A["Sep 27, 10:59 JST<br/>insightjs.com re-registered"] --> C
  B["Sep 27, 15:41 JST<br/>Code injected into 4 CDN scripts<br/>Compromise vector unknown"] --> C
  C["Launcher startup triggers<br/>download of l.js from insightjs.com"] --> D
  D["l.js uses launcher download logic<br/>to retrieve insight.bundle"] --> E
  E["K2F RAT executes<br/>debug.log logs k2f_chan registered"] --> F
  F["C2 server issues commands<br/>exfiltrating credentials, cookies, and keys"]

The fallback domain insightjs.org had remained unregistered until November 3. A third party registered it on November 4 at 02:55 JST, hosting a “NIKKE PC Launcher Security Alert” banner. The page identifies itself as an independent advisory and is not affiliated with Level Infinite.

K2F RAT Capabilities and In-Memory Behavior

K2F does not follow a fixed, pre-programmed routine. It functions as a Remote Access Trojan (RAT) that establishes a beacon, awaits instructions from a command-and-control (C2) server, executes them, and returns output. Commands identified by forensic analysis include:

Command	Action
exec	Executes arbitrary programs or system commands and returns output
ls, cd, cat, download	Navigates the filesystem and exfiltrates arbitrary files
screens	Captures screenshots across all attached monitors
creds	Decrypts NIKKE credentials saved by standard and HMT (Hong Kong/Macau/Taiwan) launchers (Google Play Games storage is outside its automated parser, but readable via cat/download)
browserscan	Collects saved passwords from Chrome, Edge, Brave, Vivaldi, Opera, and Firefox; captures Chromium cookies if collect_cookies is enabled
keyscan	Scans 264 predefined paths for credentials, tokens, and configuration files
wallet_files	Exfiltrates local data from 28 cryptocurrency wallet extensions on Chrome
chrome_install	Registers a DLL hijacking mechanism in Chrome to persist independently after the launcher closes

Because K2F operations are not recorded in standard launcher application logs, local log files cannot reveal which specific commands were dispatched to a machine. Additionally, reports indicate that the launcher manifest requested administrator privileges; under those conditions, K2F inherited full administrative access. Running the launcher under Wine or Proton (such as on Linux or Steam Deck) does not automatically provide sandboxed isolation: if the Wine prefix maps host drives (such as Z: pointing to /), user files under the host home directory are accessible to commands like cat and download.

Password Dumping and Decryption Mechanisms

The browserscan command does not decrypt passwords locally on the victim machine. For each Chrome or Edge profile, it creates single-file copies of the credential databases (Login Data and Login Data For Account), along with Cookies when configured, in the %TEMP% directory. These temporary copies follow the naming pattern k2f-bcreds-<UNIX_TIMESTAMP>-<RANDOM_STRING>.db. The tool parses host names, usernames, and encrypted password blobs from these copies, bundles them with the encryption master key, and uploads them to the C2 server for remote decryption.

Temporary database copies are deleted immediately after reading. If cleanup fails and files remain, the timestamp in the filename reveals when browserscan executed. However, the absence of these files does not indicate that no exfiltration occurred, as normal execution cleans them up. Full-screen captures follow the same pattern, written temporarily as %TEMP%\k2f_screen_<UNIX_TIMESTAMP>_<INDEX>.jpg before upload and deletion. For Firefox, logins.json and key4.db are uploaded directly. While collect_cookies was disabled in default configurations observed on analyzed PCs, the presence of cat and download means cookies could still have been extracted manually.

Modern versions of Chrome and Edge utilize App-Bound Encryption to restrict secret decryption to the calling application. K2F attempts to bypass this by borrowing the SYSTEM token from services.exe, which succeeds whenever the launcher runs with administrative rights.

Development and AI Tool Credentials Targeted

The 264 paths targeted by keyscan extend beyond standard passwords to include SSH private keys, cloud credentials (AWS, Google Cloud), GitHub CLI and npm configs, and local AI agent credentials. Examples include ~\.claude\.credentials.json, Codex’s auth.json, Gemini CLI’s oauth_creds.json, and VS Code’s mcp.json. Directories like code, dev, source, Documents, and Desktop under %USERPROFILE% are scanned for .env files and docker-compose.yml. Because passwords changes do not revoke API keys or static bearer tokens, official recommendations explicitly urge developers to revoke and regenerate credentials.

Forensic Artifacts and Verification Locations

While official instructions prioritize debug.log, community analysis documents several additional forensic artifacts. Paths starting with Launcher\ are relative to the installation root (e.g., C:\NIKKE or C:\NIKKE_GOOGLE for Google Play Games).

Path	Artifact	Significance
Launcher\intl_service\debug.log	k2f_chan registered	Indicates the RAT successfully launched and established communication
Launcher\log\tinyget\tinyget.*.log	Mentions of insight.bundle	Download log for the payload. Lines followed by curl perform success and a non-zero byte size (e.g., total=205135) confirm a completed download (result=2 or total=0 indicates failure)
Launcher\log\tinyget\	k2f.lua or files starting with 1B 4C 4A 01	RAT payload binary. Early versions may persist as k2f.lua. Any file starting with this magic byte sequence is LuaJIT bytecode
%APPDATA%\nikke_launcher\tbs_cache\Local Storage\leveldb\	k2f.agent	State storage for the RAT. Once compacted into .ldb files, simple string searches may fail
HKEY_CURRENT_USER\Software\Classes\CLSID	{E77CC89B-7401-4C04-8CED-149DB35ADD04}	Persistence registration for Chrome DLL hijacking. Note: a key with the same GUID exists in HKLM as standard Windows component
%LOCALAPPDATA%\Google\Chrome\User Data\PlatformExperienceHelper\	64-character hex folder containing platform_experience_helper.dll	Persistent malicious DLL (the folder itself is a legitimate Chrome directory)
%TEMP%	k2f-bcreds-*.db, k2f_screen_*.jpg	Remnants of credential exfiltration or screen captures; timestamps show activity times
DNS / Router logs	Lookups for insightjs.com or analytics.insightjs.com	First domain reflects script execution; second domain indicates payload retrieval

debug.log is appended on each run, preserving older session entries. However, completely uninstalling or re-downloading the game removes these historical logs.

The official launcher’s built-in inspection feature prompts users to delete suspicious logs, DLLs, and registry keys upon detection. Forensic researchers advise preserving or backing up debug.log and tbs_cache before triggering automated cleanup, as deletion prevents determining whether a system was affected. However, local artifacts alone cannot confirm which data was actually exfiltrated.

Recommended Response Measures

Official notices recommend performing the following two actions from an uncompromised machine or a thoroughly verified system:

Measure	Scope
Password Reset	Change passwords for all accounts accessed on the affected machine
API Key & Token Revocation	Revoke and regenerate all credentials and access tokens stored on the machine

Inquiries regarding non-game account anomalies or financial impacts are handled through official customer support channels. Publisher countermeasures include tightening monitoring across launcher pipelines, implementing integrity verification for external assets, and applying the principle of least privilege to client subcomponents.

Security researchers recommend additional remediation steps if active infections are suspected:

Recommended Step	Rational
Invalidate all active sessions	Stolen session cookies allow persistent access even after password changes
Regenerate SSH keys and developer tokens	keyscan specifically targeted SSH and developer configuration paths
Migrate crypto assets to clean wallets	Wallet extension data and seed phrase entry points were targeted
Consider a fresh Windows reinstallation	Arbitrary command execution (exec) was available, and some offline scanners failed to detect the persistence DLL
Block malicious destinations	Null-route insightjs.com, analytics.insightjs.com, insightjs.org, and C2 IPs (89.127.233.127, 89.126.250.172) in local hosts or router rules

As of November 5 at 08:00 JST, insightjs.com and analytics.insightjs.com were still resolving to the attacker’s infrastructure. While the CDN tampering has been resolved on the server side, affected players should promptly verify local artifacts and update their authentication credentials.