Tencent-owned game's CDN compromised to deliver trojan via PC launcher
Comments on “Tencent-owned game's CDN compromised to deliver trojan via PC launcher”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
A GitHub Gist incident report, built from one infected machine and victims' comments, says four JavaScript files on Level Infinite's CDN, loaded by the NIKKE PC launcher, carried attacker code from Sep 27. From Oct 24 at the latest, some launches installed a remote-control agent that runs commands, reads files and takes screenshots. Three files were replaced on Nov 3; two CDN servers still served the fourth that evening. The payload was analyzed statically only, and the claims lack independent sourcing. How the attacker gained CDN write access is unknown.
Why it ranked
No. 2 of 137 with a score of 0.78. The panel rated it highest on technical depth (0.97) and substantiated (0.93), lowest on audience breadth (0.51).
- AI judgeJudge 2claude-haiku-5-5
- Detailed, well-substantiated incident analysis of a supply-chain compromise via a major game's CDN, with IOCs, technical internals and remediation; highly relevant to builders and security teams, though its audience is mainly gamers and security practitioners.
- AI judgeJudge 3gpt-5.6-luna
- A highly actionable, technically detailed investigation of a CDN and launcher supply-chain compromise, including indicators, payload behavior, affected Windows/Proton systems, infrastructure evidence, and remediation guidance.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.78total under rubric v2.3
- Significance0.71
- Reader interest0.90
- Audience breadth0.51
- Practical relevance0.86
- Substantiated0.93
- Technical depth0.97
- New information0.93
- Counts against: Promotional0.02
- Counts against: Overclaim0.14
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.58 | 0.72 | 0.82 | 0.71 | 0.23 | +0.24 | +0.170 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.81 | 0.90 | 0.98 | 0.90 | 0.17 | +0.26 | +0.233 |
| Audience breadthHow many people who build technology does it concern? | 0.36 | 0.60 | 0.58 | 0.51 | 0.24 | +0.13 | +0.067 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.82 | 0.85 | 0.91 | 0.86 | 0.09 | +0.22 | +0.189 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.96 | 0.90 | 0.93 | 0.93 | 0.06 | +0.05 | +0.047 |
| Technical depthHow technically substantive is it? | 1.00 | 0.95 | 0.97 | 0.97 | 0.05 | +0.05 | +0.049 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.91 | 0.90 | 0.98 | 0.93 | 0.08 | +0.05 | +0.047 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.04 | 0.02 | 0.01 | 0.02 | 0.03 | −0.19 | −0.004 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.23 | 0.10 | 0.08 | 0.14 | 0.15 | −0.11 | −0.015 |
| Sum of contributions | +0.781 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.781 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-04/2/"><img src="https://rubric.hrih.si/badge/2026-11-04/2.svg" alt="Ranked #2 on Rubric, 4 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 8 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenDate
From 2026-09-27, four official JavaScript files on Level Infinite's CDN contained attacker code that the NIKKE PC launcher loads.
The article gives no link or citation for it.
The article says “From 2026-09-27, four official JavaScript files on Level Infinite's CDN contained attacker code”
The source says No source to compare with.
No source givenNumber
The payload has been active since Oct 24, 2026 at the latest, and only on some launches (one machine got it on 3 of about 19 launches).
The article gives no link or citation for it.
The article says “one machine got it on 3 of about 19 launches”
The source says No source to compare with.
No source givenDate
Three modified files (aegis-fix.min.js, vue-bucket.min.js, images.7fec4c32.js) were replaced with clean copies on Nov 3 at 17:04, 17:13 and 17:21 GMT.
The article gives no link or citation for it.
The article says “aegis-fix.min.js, vue-bucket.min.js and images.7fec4c32.js replaced on Nov 3 at 17:04, 17:13 and 17:21 GMT”
The source says No source to compare with.
No source givenNumber
FeedList.feb647c9.js was cleaned at the origin on Oct 28, but two CDN servers still delivered the modified copy at 22:26 GMT on Nov 3.
The article gives no link or citation for it.
The article says “The fourth, FeedList.feb647c9.js, was cleaned at the origin on Oct 28, but two CDN servers still delivered the modified copy at 22:26 GMT”
The source says No source to compare with.
No source givenCausal conclusion
The installed agent lets the attacker run any command, read any file and take screenshots while the launcher is open.
The article gives no link or citation for it.
The article says “while the launcher was open, the attacker could run any command on your machine, read any file and take screenshots”
The source says No source to compare with.
No source givenNumber
The payload, insight.bundle, is 205,135 bytes with SHA-256 cc0ad05bfe85940a6067b3a72c182d3953339129206634141926d5d0b35973ec (copy fetched 2026-11-03 16:22 GMT).
The article gives no link or citation for it.
The article says “Size 205,135 bytes”
The source says No source to compare with.
No source givenQuote
1984 ehf, the Iceland hosting provider, replied to an abuse report that 89.127.233.127 had been shut down.
The article gives no link or citation for it.
The article says “1984 ehf replied to an abuse report that 89.127.233.127 "has been shut down”
The source says No source to compare with.
No source givenNumber
Microsoft Defender Offline did not detect the malicious DLL on one machine (signatures 1.463.110.0).
The article gives no link or citation for it.
The article says “Microsoft Defender Offline did not detect the DLL on one machine (signatures 1.463.110.0), so a clean antivirus scan does not mean it is gone”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 9 pts, not on front page
Recorded for context only, checked 4 Nov 2026, 05:47 UTC. It played no part in the ranking.