Level Infinite - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/level-infinite/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 16:22:08 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgNIKKE Game Launcher Compromised for Info Stealer Deliveryhttps://feed.craftedsignal.io/briefs/2026-11-nikke-launcher-stealer/Thu, 12 Nov 2026 16:22:08 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-nikke-launcher-stealer/Unknown actors compromised the NIKKE game launcher's server-pushed task channel to deliver a Lua-based info stealer disguised as a log file, enabling the theft of browser credentials, crypto-wallet data, and developer secrets.Bitdefender researchers identified a credential theft campaign targeting users of the Goddess of Victory: NIKKE game launcher. Attackers leveraged the launcher's server-pushed task channel to deliver a malicious payload, dubbed k2f-agent, which executed within the context of the signed launcher process. The payload was obfuscated LuaJIT bytecode masquerading as a standard log file. The k2f-agent registered a service via the launcher's embedded JS-to-native bridge to perform credential harvesting and exfiltration. The malware leaves minimal artifacts on disk, as malicious code execution occurred primarily in unbacked heap memory.

Attack Chain

  1. The launcher queried its backend for tasks upon login.
  2. The backend returned a task including a URL to a payload disguised as a log file.
  3. The launcher's downloader fetched and saved the payload to a local log directory.
  4. The launcher's Lua VM loaded the bundle, which registered a new service ('k2f_chan') via the launcher's JS-to-native bridge.
  5. Remote operators issued commands over this bridge to harvest data.
  6. Exfiltration occurred via the launcher's existing outbound telemetry infrastructure.

Impact

The stealer harvested browser passwords, cookies, SSH keys, GPG keys, Git credentials, Kubernetes configs, environment variables, Windows Credential Manager entries, and cryptocurrency wallet data from MetaMask, Phantom, Coinbase Wallet, Keplr, and TronLink. The entire process from download to cleanup typically completed in under 10 minutes.

Recommendation

Users who utilized the affected launcher during the incident window should consider their machines compromised. Recommended actions include rotating all stored browser passwords, generating new seed phrases for crypto-wallets on clean hardware, and rotating all stored developer secrets (SSH keys, GPG keys, Git credentials, etc.).

]]>highthreatcredential-theftinfo-stealersupply-chain