Search — “insight.bundle”

Attackers modified four JavaScript files on Level Infinite's official CDN (from Sept 27, 2026) used by the Goddess of Victory: NIKKE PC launcher, injecting an obfuscated loader that pulled code from insightjs[.]com / insightjs[.]org. Per researcher MotherSphere, the code abused launcher functionality to run a LuaJIT payload (insight.bundle) that installed the K2F remote-access agent. K2F could execute commands, steal files, screenshots, browser data and credentials, and optionally drop platform_experience_helper.dll with crypto-wallet theft code; whether the DLL was deployed or crypto stolen is unknown. Hunt for DNS/proxy traffic to the insightjs domains, the k2f_chan string in Launcher/intl_service/debug.log, and platform_experience_helper.dll on endpoints.