Tencent-owned game's CDN compromised to deliver trojan via PC launcher
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A GitHub Gist incident report, built from one infected machine and victims' comments, says four JavaScript files on Level Infinite's CDN, loaded by the NIKKE PC launcher, carried attacker code from Sep 27. From Oct 24 at the latest, some launches installed a remote-control agent that runs commands, reads files and takes screenshots. Three files were replaced on Nov 3; two CDN servers still served the fourth that evening. The payload was analyzed statically only, and the claims lack independent sourcing. How the attacker gained CDN write access is unknown.