Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In late September 2026, threat actors compromised four JavaScript files hosted on Level Infinite's official CDN that powered the PC launcher for the popular mobile-and-PC RPG Goddess of Victory: NIKKE, which has surpassed 45 million downloads since 2022. The tampered scripts—undetected for roughly five weeks—silently downloaded obfuscated code from attacker-controlled domains (insightjs[.]com / insightjs[.]org) and deployed a LuaJIT backdoor known as K2F. The backdoor enabled remote command execution, file exfiltration, screenshot capture, NIKKE credential harvesting, and browser-stored data theft. A secondary Windows DLL (platform_experience_helper.dll) targeted cryptocurrency wallet extensions including MetaMask, Phantom, and Coinbase Wallet. Level Infinite acknowledged the tampering on November 4, 2026 and issued an emergency client update.

This incident exemplifies the accelerating threat of CDN and build-pipeline supply-chain attacks, where a single poisoned distribution point can silently weaponize a trusted software update for millions of end users. As gaming platforms expand their payment and crypto-wallet integrations, they become high-value targets for financially motivated actors blending infostealer and RAT capabilities into a single stealthy implant.

Why This Matters Now

Supply-chain attacks targeting CDN-hosted launcher scripts are surging in 2026, with adversaries increasingly pairing credential-stealing infostealers with persistent RAT backdoors in a single payload. The NIKKE incident—affecting a platform with 45 million registered users—shows that entertainment and gaming companies with embedded crypto-wallet and payment surfaces now carry enterprise-grade breach risk, yet often lack the egress controls and network segmentation to detect covert outbound C2 communications before mass data loss occurs.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Attackers modified JavaScript files hosted on Level Infinite's official CDN on September 27, 2026, embedding obfuscated loaders that blended into legitimate code. The absence of file-integrity monitoring on CDN-distributed assets and lack of outbound egress controls to detect communication with novel C2 domains (insightjs[.]com/org) allowed the compromise to persist undetected until November 3–4, 2026.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker's entire operational chain depended on unrestricted outbound connectivity from compromised endpoints to attacker-controlled infrastructure and open lateral access to credential stores. By enforcing segmented, identity-aware network boundaries and controlled egress policies, CNSF would likely have reduced the attacker's ability to beacon out, retrieve secondary payloads, and exfiltrate stolen credentials at scale.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: CNSF's fabric-wide visibility across workload communication paths would likely reduce the window of undetected CDN-sourced payload delivery by surfacing anomalous outbound domain resolution attempts to attacker-registered infrastructure, limiting how broadly the injected loader could establish initial callback reach across the player population.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation policies would likely constrain the escalated process's ability to reach sensitive internal resources or adjacent workloads, since access grants would need to be identity- and context-scoped rather than inherited from the host process — reducing the effective privilege scope available to the malicious loader and its persistent DLL.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement would likely reduce the K2F agent's ability to pivot from a compromised game client into adjacent enterprise segments or other networked workloads, since micro-segmentation policies would constrain lateral reachability between workloads that have no legitimate reason to communicate — limiting the inferred cross-host movement paths the backdoor could exploit.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility and control would likely reduce the attacker's ability to sustain reliable C2 communication by surfacing anomalous outbound connection patterns to attacker-registered domains across monitored traffic flows, potentially constraining the fallback domain strategy by making both the primary and secondary C2 channels visible and subject to policy-based access evaluation.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security and policy enforcement would likely constrain the volume and reach of data exfiltration by limiting which outbound destinations the compromised launcher process could communicate with, reducing the attacker's ability to freely transmit harvested credentials and wallet keys to attacker-controlled domains without those outbound flows being evaluated against defined egress policy.

Impact (Mitigations)

Had prior CNSF controls constrained C2 reachability and egress paths, the residual impact would likely be reduced in scope — fewer victim endpoints would have successfully transmitted harvested credentials and wallet keys to attacker infrastructure, limiting the realized financial loss and shrinking the population of users requiring emergency credential rotation and OS reinstallation.

Impact at a Glance

Affected Business Functions

  • Game Client Distribution and Update Delivery (CDN Integrity)
  • Player Account Authentication and Credential Management
  • Cryptocurrency Wallet Security for End Users
  • Customer Trust and Platform Reputation
Operational Disruption

Estimated downtime: 2 days

Financial Impact

Estimated loss: N/A

Data Exposure

The malware deployed through the compromised NIKKE PC launcher was capable of stealing NIKKE account credentials, browser-stored passwords and session tokens, and cryptocurrency wallet data including recovery phrases and private keys from browser extensions such as MetaMask, Phantom, and Coinbase Wallet. The attack potentially affected any of the approximately 45 million registered players who used the PC launcher between September 27, 2026 (date of script modification) and November 4, 2026 (date of patched client update). The K2F backdoor also enabled remote command execution, local file browsing and exfiltration, and screenshot capture, meaning arbitrary sensitive personal files on affected Windows systems were at risk. The DLL component platform_experience_helper.dll could persist after launcher closure, extending the exposure window beyond active gameplay sessions. Financial loss estimate is listed as $0 because no confirmed theft figures have been publicly disclosed by Level Infinite, though the potential for significant cryptocurrency theft from affected users is high given the wallet-targeting capability of the DLL payload.

Recommended Actions

  • • Enforce Egress Security & Policy Enforcement against attacker C2 domains: Deploy CNSF egress controls with FQDN filtering to block outbound connections from game launcher processes to unauthorized or newly registered domains such as insightjs[.]com and insightjs[.]org; policy enforcement aligned with ZTMM.Data and NIST.800-53.SC-18 would have severed the malicious payload download chain at the initial execution stage.
  • • Apply Cloud Firewall (ACF) with AI-driven traffic discovery for anomalous outbound patterns: Aviatrix Cloud Firewall with URL filtering and AI discovery of traffic can identify and alert on unusual outbound connections originating from game client processes to unknown external domains, providing a detection and blocking layer even when JavaScript obfuscation conceals the destination at the application layer.
  • • Leverage Inline IPS (Suricata) to detect known-malicious payload signatures: Inline IPS with updated threat signatures for LuaJIT-based loaders, obfuscated JavaScript dropper patterns, and RAT beaconing behaviors (K2F agent) would have identified and blocked the malicious insight.bundle retrieval and subsequent C2 beacon traffic before credential exfiltration occurred.
  • • Implement Multicloud Visibility & Control to establish behavioral baselines for CDN-delivered content: Centralized traffic observability and anomaly detection aligned with ZTMM.CrossCutting.Visibility and NIST.800-53.AU-6 would have flagged the sudden introduction of new external domain callouts within launcher update scripts in late September, triggering investigation nearly five weeks before the compromise was publicly disclosed.
  • • Apply Zero Trust Segmentation and least-privilege process isolation: Microsegmentation and identity-based policy enforcement (ZTMM.Network, NIST.800-53.AC-6) should restrict game launcher processes from accessing browser credential stores, cryptocurrency wallet extension directories, and arbitrary filesystem paths, containing the blast radius of any future supply-chain compromise to the game context and preventing cross-application credential harvesting.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image