NIKKE game launcher used to deliver Lua information stealer

Bitdefender researchers say attackers used Goddess of Victory: NIKKE’s legitimate PC launcher to deliver a Lua-based information stealer, dubbed k2f-agent. The campaign did not alter the game’s files or exploit a vulnerability: attackers used the launcher’s server-pushed task channel to provide a download URL at runtime. The 205,135-byte payload arrived disguised as a log file containing LuaJIT bytecode, then ran inside the launcher through its embedded browser and JavaScript-to-native bridge.

The 46-module stealer can search Chrome, Edge and Opera profiles for saved passwords and, according to Bitdefender, supports decryption of Chrome credentials protected by App-Bound Encryption. It also targets the MetaMask, Phantom, Coinbase Wallet, Keplr and TronLink extensions, and can collect developer and system secrets including SSH and GPG keys, Git credentials and Kubernetes configurations.

In the captured run, the operator did not invoke the modules for those latter secrets, and cookie collection was disabled. Stolen data travelled through the launcher’s normal encrypted telemetry connection; download, collection, exfiltration and cleanup took about six to 10 minutes.

Bitdefender says detections began on 30 October 2026 and that its Advanced Threat Defense terminated the launcher on protected systems it observed, before personal information could be exfiltrated. The delivery domain, `analytics.insightjs[.]com`, resolved to an Iceland-hosted server and had been registered about five weeks earlier; the hosting provider has since taken the server down. The operators’ identities and how they gained access to the task channel remain unknown.

Bitdefender said it had no evidence that NIKKE’s developer or publisher was involved. It advised people who used the affected launcher during the attack window to treat their machines as compromised and rotate exposed passwords, wallet seed phrases and developer credentials.