Overview
- Independent researchers say four JavaScript files on Level Infinite’s CDN were modified to load obfuscated code that fetched a LuaJIT payload called insight.bundle and installed a remote-access agent named K2F.
- Those injected scripts first appeared on September 27, 2026 and researchers estimate the malicious chain could have been used in practice from late October, exposing PCs that launched the game to remote control and data theft.
- Level Infinite and Shift Up issued client fixes and a launcher update on November 4 and said they are investigating, but researchers reported at least one compromised script may have still been served after the initial fixes.
- Analysts found a Windows DLL on VirusTotal with strings that target browser wallet extensions such as MetaMask and Phantom, but there is no public confirmation that the DLL was deployed to users or that funds were stolen.
- Researchers and outlets have published clear checks and remediation steps, including searching the launcher debug.log for the k2f_chan marker, running updated antivirus scans, reinstalling the client from a clean device, and changing credentials if compromise is confirmed.