Loading malware…
K2F is a Windows remote-access trojan distributed through a supply-chain compromise of the Goddess of Victory: NIKKE PC launcher. Attackers modified legitimate JavaScript hosted on publisher Level Infinite's content delivery infrastructure. When players opened the launcher, the injected code retrieved additional malicious code that abused native launcher functionality to execute a LuaJIT payload and install K2F.
K2F enables remote command execution, local file browsing and downloading, screenshot capture, and theft of NIKKE account credentials and browser-stored information. It also supports a command to install an additional malicious Windows DLL with functionality to intercept cryptocurrency wallet recovery phrases and private keys, including those associated with MetaMask, Phantom, and Coinbase Wallet. This optional component can remain active after the launcher closes; its deployment on affected systems and successful cryptocurrency theft have not been confirmed. The campaign targeted users of the game's Windows PC launcher, and no threat actor attribution has been established.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.