Overview
- Independent researcher MotherSphere found four JavaScript files on Level Infinite’s CDN were altered on September 27, 2026 to inject code that could download and run additional payloads through the official Windows launcher.
- Those payloads reportedly installed a remote‑access agent called K2F that can run commands, browse and exfiltrate files, take screenshots, and collect saved credentials and browser data.
- Forensics show a possible additional Windows DLL with strings that target browser wallet extensions such as MetaMask and Phantom, but researchers say it is not yet confirmed whether that DLL was widely deployed or led to cryptocurrency theft.
- Level Infinite issued a client update on November 4, 2026 that replaced tampered files, refreshed CDN content, and added an in‑client malware scan and removal feature while advising players to update, scan from a clean device, and change credentials.
- The total number of affected PCs and any data or fund losses remain unknown as investigators reconcile conflicting timelines and continue forensic work; the incident highlights the risk of supply‑chain compromises that can harm large game install bases.