General Gaming News and Discussion

Malakriss

Malakriss

Avatar of War Slayer
13,404
12,771

Apparently a malware actor gained access to Level Infinite's CDN and hooked stuff into their PC launchers for games that updated recently. If you played NIKKE at all in the last couple weeks you are likely compromised. (PC versions, mobile doesn't use the launchers)

edit: some users claimed other game launchers from Level Infinite had initial entries and first stage files but nothing provided to analysts, so either fearmongering or not widespread.
- Goddess of Victory Nikke
- PUBG Mobile
- Delta Force
- Honor of Kings
- Arena Breakout
- Dune Awakening
- Age of Empire Mobile
- Undawn

(Forum keeps converting link to wall of text)
Code: 
https://gist.github.com/MotherSphere/d6c049a09ba8ac3085c51ee9df24a4e5
From 2026-09-27, four official JavaScript files on Level Infinite's CDN contained attacker code. The NIKKE PC launcher loads these files. From Oct 23 at the latest, opening the launcher could install a remote-control agent: while the launcher was open, the attacker could run any command on your machine, read any file and take screenshots.
Click to expand...
 
Last edited:
  • 1WTF
  • 1Seriously?
Reactions: 1 users
Kajiimagi

Kajiimagi

<Aristocrat╭ರ_•́>
6,742
11,407
Malakriss said:
Apparently a malware actor gained access to Level Infinite's CDN and hooked stuff into their PC launchers for games that updated recently. If you played these at all in the last couple weeks you are likely compromised (PC versions, mobile doesn't use the launchers)
- Goddess of Victory Nikke
- PUBG Mobile
- Delta Force
- Honor of Kings
- Arena Breakout
- Dune Awakening
- Age of Empire Mobile
- Undawn

(Forum keeps converting link to wall of text)
Code: 
https://gist.github.com/MotherSphere/d6c049a09ba8ac3085c51ee9df24a4e5
Click to expand...
and so it begins
 
Malakriss

Malakriss

Avatar of War Slayer
13,404
12,771
Cybsled said:
Where are you finding this extra info? All I can find is shit about Nikke online
Click to expand...
There's no official post by Shiftup (Nikke has now tweeted to acknowledge), Tencent, or Level Infinite yet so it's self-reports from people playing games that use their launcher and having some of the preliminary debug and files showing up. Nikke looks like the primary target with various levels of remote access and data pulls, passwords and crypto wallets associated with browsers. Lots of partial installs have been reported where some search strings and connections don't show up but the initial stage of compromised files are still present and need to be purged obviously. Attacker entries may be cached locally after a game uninstall so there are extra things to clean.

Timeline so far is Sep 27 CDN was compromised, sites and certificates were registered in early Oct but they waited for the Nikke anniversary and backdoor agent connections happened around the Oct 23 - Nov 3 time period.

edit: Malwarebytes is now detecting this as Loader.K2F, Trace.K2F, etc

 
Last edited:
Cybsled

Cybsled

Naxxramas 1.0 Raider
19,145
15,644
Funcom just announced Dune wasn’t impacted because not only did the launcher get removed a bit ago, but Funcom’s was in-house and didn’t share any code with the other impacted launchers
 
  • 2Like
Reactions: 1 users
Fogel

Fogel

Mr. Poopybutthole
17,237
74,177
Bro was starting to think maybe he showed up to the wrong interview

 
  • 7Worf
  • 1Pathetic
Reactions: 7 users
Noodleface

Noodleface

A Mod Real Quick
40,697
20,806
Malakriss said:
There's no official post by Shiftup (Nikke has now tweeted to acknowledge), Tencent, or Level Infinite yet so it's self-reports from people playing games that use their launcher and having some of the preliminary debug and files showing up. Nikke looks like the primary target with various levels of remote access and data pulls, passwords and crypto wallets associated with browsers. Lots of partial installs have been reported where some search strings and connections don't show up but the initial stage of compromised files are still present and need to be purged obviously. Attacker entries may be cached locally after a game uninstall so there are extra things to clean.

Timeline so far is Sep 27 CDN was compromised, sites and certificates were registered in early Oct but they waited for the Nikke anniversary and backdoor agent connections happened around the Oct 23 - Nov 3 time period.

edit: Malwarebytes is now detecting this as Loader.K2F, Trace.K2F, etc

Click to expand...

Question 1 - what the fuck is this weeb shit
 
  • 2Like
  • 1Worf
Reactions: 2 users
kroenen

kroenen

Regimen Morum
8,259
34,797

Music Video Wtf GIF
 
  • 6WTF
  • 1Mother of God
Reactions: 6 users
You must log in or register to reply here.