{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/info-stealer/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NIKKE game launcher"],"_cs_severities":["high"],"_cs_tags":["credential-theft","info-stealer","supply-chain"],"_cs_type":"threat","_cs_vendors":["Level Infinite","Shift Up"],"content_html":"\u003cp\u003eBitdefender researchers identified a credential theft campaign targeting users of the Goddess of Victory: NIKKE game launcher. Attackers leveraged the launcher's server-pushed task channel to deliver a malicious payload, dubbed k2f-agent, which executed within the context of the signed launcher process. The payload was obfuscated LuaJIT bytecode masquerading as a standard log file. The k2f-agent registered a service via the launcher's embedded JS-to-native bridge to perform credential harvesting and exfiltration. The malware leaves minimal artifacts on disk, as malicious code execution occurred primarily in unbacked heap memory.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe launcher queried its backend for tasks upon login.\u003c/li\u003e\n\u003cli\u003eThe backend returned a task including a URL to a payload disguised as a log file.\u003c/li\u003e\n\u003cli\u003eThe launcher's downloader fetched and saved the payload to a local log directory.\u003c/li\u003e\n\u003cli\u003eThe launcher's Lua VM loaded the bundle, which registered a new service ('k2f_chan') via the launcher's JS-to-native bridge.\u003c/li\u003e\n\u003cli\u003eRemote operators issued commands over this bridge to harvest data.\u003c/li\u003e\n\u003cli\u003eExfiltration occurred via the launcher's existing outbound telemetry infrastructure.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe stealer harvested browser passwords, cookies, SSH keys, GPG keys, Git credentials, Kubernetes configs, environment variables, Windows Credential Manager entries, and cryptocurrency wallet data from MetaMask, Phantom, Coinbase Wallet, Keplr, and TronLink. The entire process from download to cleanup typically completed in under 10 minutes.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUsers who utilized the affected launcher during the incident window should consider their machines compromised. Recommended actions include rotating all stored browser passwords, generating new seed phrases for crypto-wallets on clean hardware, and rotating all stored developer secrets (SSH keys, GPG keys, Git credentials, etc.).\u003c/p\u003e\n","date_modified":"2026-11-12T16:22:08Z","date_published":"2026-11-12T16:22:08Z","id":"https://feed.craftedsignal.io/briefs/2026-11-nikke-launcher-stealer/","summary":"Unknown actors compromised the NIKKE game launcher's server-pushed task channel to deliver a Lua-based info stealer disguised as a log file, enabling the theft of browser credentials, crypto-wallet data, and developer secrets.","title":"NIKKE Game Launcher Compromised for Info Stealer Delivery","url":"https://feed.craftedsignal.io/briefs/2026-11-nikke-launcher-stealer/"}],"language":"en","title":"CraftedSignal Threat Feed - Info-Stealer","version":"https://jsonfeed.org/version/1.1"}