Attackers Abuse NIKKE Launcher to Deliver Lua-Based Credential Stealer

Nov 12, 2026 · Original article ↗

Summary

Bitdefender researchers say attackers abused NIKKE’s server-pushed launcher task channel to run the Lua-based k2f-agent stealer, targeting browser credentials, wallets and developer secrets. The delivery server is down; the operators and access method remain unknown.

Key points

Attackers used NIKKE’s server-pushed task channel to download and run a payload without modifying the launcher binary or exploiting a vulnerability.
The k2f-agent payload was obfuscated LuaJIT bytecode disguised as a log file; it ran inside the legitimate launcher through its embedded browser and JavaScript-to-native bridge.
The stealer targets Chrome, Edge and Opera credential stores and supports Chrome’s App-Bound Encryption. The operator can also direct cookie collection.
The payload targets five cryptocurrency wallet extensions and includes modules for collecting developer and system secrets; Bitdefender says the key-collection modules were not invoked in the captured run.
Stolen data was sent over the launcher’s normal encrypted telemetry channel. Researchers estimate the download, collection, exfiltration and cleanup took about 6–10 minutes.
Bitdefender says its Advanced Threat Defense terminated the launcher on observed protected systems before exfiltration. The hosting provider took down the delivery server; the operators and how they accessed the task channel remain unknown.

Article Details

Attack Vectors: Operators used the NIKKE launcher's server-pushed task channel to make its downloader fetch the payload from attacker-controlled delivery infrastructure.
The payload was LuaJIT bytecode disguised as a log file. It ran in the launcher's Lua VM through the embedded browser's JavaScript-to-native bridge, without modifying the launcher binaries or game distribution files.
The stealer targeted browser credentials and crypto-wallet extension vaults. Its modules also supported collecting developer and system secrets, although the article says the operator did not invoke the keyscan modules in the captured run.
Stolen data was sent through the launcher's existing encrypted telemetry channel; the article says there is no reason to believe that telemetry infrastructure was attacker-controlled.
Defensive Notes: Monitor for a non-browser process opening browser credential databases, Local State files, or browser-extension vault files.
Look for temporary files matching %TEMP%\k2f-bcreds-.db and large .log files beginning with LuaJIT bytecode bytes (\x1bLJ\x01).
Monitor launcher or game processes connecting to domains outside known vendor infrastructure, especially recently registered domains.
The article recommends rotating passwords stored in Chrome, Edge, and Opera; moving wallet assets to new seed phrases generated on a clean machine; and rotating developer secrets and other potentially collected credentials.
Bitdefender reported that Advanced Threat Defense terminated the launcher on the protected systems it observed before personal information could be exfiltrated. The delivery server was reported taken down.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`analytics[.]insightjs[.]com`	Attacker-used delivery subdomain that served the LuaJIT payload to the launcher.
DOMAIN	`insightjs[.]com`	Recently registered delivery domain; the article believes the campaign was run by its operators.
IPV4	`89[.]127[.]233[.]127`	IP address to which the malicious delivery subdomain resolved during the attack.
SHA256	`cc0ad05bfe85940a6067b3a72c182d3953339129206634141926d5d0b35973ec`	SHA-256 hash listed for the malicious payload.
URL	`hxxps[:]//analytics[.]insightjs[.]com/comm/assets/insight.bundle`	Specific attacker-used URL from which the launcher downloaded the disguised LuaJIT payload.