NIKKE PC launcher compromise (Nov 2026): Level Infinite CDN files modified, remote-control agent, indicators

NIKKE PC launcher compromise (November 2026)

Caution

From 2026-09-27, three official JavaScript files on Level Infinite's CDN contained attacker code. The NIKKE PC launcher loads these files. From Nov 1 at the latest, opening the launcher could install a remote-control agent: while the launcher was open, the attacker could run any command on your machine, read any file and take screenshots.

Update, 2026-11-03 19:10 GMT: Level Infinite replaced two of the files at 17:04 and 17:21 GMT. The third, FeedList.feb647c9.js, was cleaned at the origin on Oct 28, but two CDN servers still delivered the modified copy at 18:59 GMT. The attacker's server no longer answered at 18:31 GMT. None of this undoes anything on machines that were already infected, and the old files may still be in your launcher's cache. Do not open the NIKKE PC launcher until Level Infinite confirms the fix, and clear its cache before you do.

This report comes from one infected machine, plus findings from other victims posted in the comments. The payload was analyzed statically and never executed. Everything below was checked against the downloaded files, the launcher's logs and caches, the decompiled payload and the live servers. Findings from the comments are marked as reported when they could not be checked here.

Last updated: 2026-11-03, 19:10 GMT. Corrections in this update: a third modified file, FeedList.feb647c9.js (found by RichyRich515 and Enerccio in the comments, confirmed here); the payload was served from Nov 1 at the latest, not Nov 2-3; debug.log is appended to, not overwritten on each launch; collect_cookies: false does not mean cookies were safe. Earlier corrections: the PlatformExperienceHelper folder itself is normal Chrome (only a 64-hex subfolder with the DLL is malicious), and onominan.tmp is not a malware marker.

Contents

Summary

Check if you are infected

1. Open your NIKKE install folder.
2. Open Launcher/intl_service/debug.log in a text editor.
3. Search for k2f_chan.

If you find it, the agent ran on your machine. An infected log looks like this:

"lua downloaded to log\tinyget\tinyget..log"
"k2f_chan registered"
"adopted "
"agent started as "

Launcher/log/tinyget/tinyget.*.log also records the download of https://analytics.insightjs.com/comm/assets/insight.bundle.

The launcher appends to debug.log: on the analyzed machine it held all 9 launches from Oct 29 to Nov 3. It is gone if the NIKKE folder was deleted or reinstalled. FETCH_LIST suc success lines come from the normal FeedList module and appear on clean launches too, so they are not a sign.

The agent also saves its state in the launcher's Local Storage, outside the NIKKE folder: search the files in %APPDATA%\nikke_launcher\tbs_cache\Local Storage\leveldb\ for k2f.agent. On Windows, also check for the persistence files listed in .

What to do

Everyone

1. Do not open the NIKKE PC launcher until Level Infinite confirms the fix.
2. Before you open it again, delete the launcher's cache folder %APPDATA%\nikke_launcher\tbs_cache (inside your prefix on Proton). It may still hold the modified files from before the fix.
3. Block these in your hosts file, router or firewall:

   insightjs.com
   analytics.insightjs.com
   insightjs.org
   89.127.233.127
   

   This only stops the current server. How the attacker got write access to Level Infinite's CDN is not known yet, so they may be able to try again with a new domain.

If you are infected

1. Close the launcher, or disconnect from the internet, so the attacker loses access.
2. On Windows, remove the persistence:
   • Open %LOCALAPPDATA%\Google\Chrome\User Data\PlatformExperienceHelper\. Delete any subfolder whose name is a 64-character hex string and that holds platform_experience_helper.dll. Do not delete the whole folder: Chrome creates PlatformExperienceHelper itself for its own platform_experience_helper.exe, so the folder on its own is normal.
   • Delete HKCU\Software\Classes\CLSID\{E77CC89B-7401-4C04-8CED-149DB35ADD04} if it exists. The same CLSID also exists under HKLM on every Windows install, pointing to wpc.dll (WindowsParentalControls). Leave that one. Only the HKCU copy is malicious.
   • Reinstalling Windows is the safest option, because the attacker could run any command while the agent was active.
3. From a clean device, change your passwords: NIKKE / Level Infinite first, then email, Discord, banking and every password saved in a browser. Turn on two-factor authentication.
4. Log out of all sessions (Discord, Google, Steam, GitHub and others). The agent can steal browser cookies, which work without your password.
5. Revoke and regenerate API tokens, SSH keys and any developer credentials (GitHub, npm, AWS, OpenAI, Anthropic and others).
6. Move crypto wallet funds to a new wallet with a new seed phrase.

What the attacker can do on an infected machine

The agent is a remote-access tool controlled by the operator. It does not only run a fixed stealing routine. While the launcher is open, the operator can send these commands:

exec alone means the operator can do anything your user account can do: install other malware, read any document or change files. The other commands are shortcuts.

None of these commands leaves an entry in the launcher logs. A victim cannot tell from the logs which commands were run, so assume the worst.

Linux and Steam Deck (Proton)

Proton does not protect you.

The automatic scans look for Windows paths, so they find little in a Proton prefix. On the machine analyzed here, the only target present inside the prefix was the NIKKE launcher data.

The remote commands are a different matter. Wine maps your Linux home folder and / as drive letters (Z: at least). It also passes your environment variables to the game, and the agent reads all of them. With exec, ls, cat and download, the operator can read anything your Linux user can read: ~/.ssh, browser profiles, shell config files with API keys, password stores and documents. The Windows Chrome persistence does not apply on Linux, but treat every secret in your home folder and environment as exposed.

Technical details

Stage 1: modified official files

Code was added to three files on Level Infinite's CDN:

Modified versions (the first two fetched on Nov 3 before the fix, the third on Nov 3 at 18:57 GMT):

Clean versions (no loader and no reference to insightjs):

All versions are served by tencent-cos. Which copy of FeedList.feb647c9.js a launcher gets depends on the CDN server it reaches. On Nov 3 between 18:57 and 18:59 GMT, 43.152.43.115 (the address Cloudflare and Google DNS returned to the analyzing machine) served the clean copy. 43.175.144.148 and 43.175.145.181 served the modified copy, SHA-256 2f2aac505f486067af6831d6c75ea74df63acb1ed4e4002709c5962c68bd9203, from a cache dated Sep 30, and returned it for a cache-busting query string too. images.7fec4c32.js was clean on all three servers.

The injected code hides the URL in an integer array (new TextDecoder().decode(new Uint8Array(new Uint32Array().buffer))). It adds a tag, then removes it from the page after loading. If insightjs.com fails, it retries with the TLD replaced by .org (built with String.fromCharCode(111,114,103) in FeedList.feb647c9.js). In FeedList.feb647c9.js the 708 added bytes sit just before the module's final export{...} statement, so a check that compares only the end of a file misses them.

The injected code logs startup already in progress to debug.log with an empty source, apparently when another loader has already started the agent. On the analyzed machine that line came at 01:47:35, one second before the download, with only two loaders in the cache.

The launcher's V8 code cache (tbs_cache\Code Cache\js\) stores the scripts under keys such as https://insightjs.com/l.js?f=aegis, with https://playerinfinite.com/ as origin. The analyzed machine had the aegis and images keys. Another victim reported all three, including ?f=feedlist.

Stage 2: payload download

l.js calls the launcher's own JS bridge (Srv_DownloadFile) to fetch:

The server changed the file on Nov 3 at 14:56 GMT, so earlier victims may have received a different build of the same size.

The launcher saves the payload under a misleading .log name in Launcher\log\tinyget\, runs it, then deletes it.

An earlier version of this report listed a 22-byte hex file in %LOCALAPPDATA%\Temp\ (onominan.tmp) as a marker. That was wrong. The same file name with the same kind of content exists in Delta Force Wine prefixes dated 2026-09-20, before the CDN files were changed, so it comes from Tencent software and does not show infection.

Stage 3: the agent

• Format: LuaJIT 2.0 bytecode (32-bit, stripped), obfuscated with Prometheus. The strings are stored in a shuffled table with custom base64 and base85 encoding.
• Internal build name: K2F_LUA_BUILD.
• Windows access through LuaJIT FFI: CredEnumerateW, CryptUnprotectData, NCryptDecrypt, BCrypt*, Reg*, CreateProcessW, CreatePipe, GetEnvironmentStringsW, GetLogicalDrives, GetAdaptersInfo, GDI+.
• Protocol: JSON requests over k2f_chan ({op: "open", cmd: "", arg: {...}}, then read and write on a session ID). Output is returned base64-encoded in chunks of up to 2 MiB.
• State: the agent stores k2f.agent.state in the launcher's Local Storage (origin https://www.nikkelauncher.com, tbs_cache\Local Storage\leveldb\). On the analyzed machine it held agent_id (the same UUID as the adopted log line), agent_pass, c2s_counter: 4, an s2c_counter that looks like a microsecond timestamp (2026-11-03 00:47:37 GMT), and this config: poll_interval_seconds: 1800, jitter_seconds: 360, collect_cookies: false. The agent checks in with the server every 30 minutes, give or take 6. The s2c_counter value, 1793666857535416, is 2026-11-03 00:47:37.535 GMT in microseconds, two seconds after the agent started. Older values of the key stay in the LevelDB .log file until LevelDB compacts it. One victim's file showed 11 check-ins over 3 hours, with c2s_counter going up by one each time and the server switching the interval between 600, 1800 and 900 seconds (reported in the comments). The Lua payload never reads or writes the two counters, so they are handled by l.js, and what makes c2s_counter go up could not be confirmed from code.
• collect_cookies is an argument of browserscan. When it is false, the cookie stores are skipped and saved passwords are read anyway. cat, download and exec can still copy a browser's Cookies file, so false in the saved config does not mean the cookies were safe.
• Modules: base64, json, channel, dispatch, commands.*, keyscan.*, win32.chrome, win32.creds, win32.exec, win32.extensions, win32.firefox, win32.fs, win32.hook, win32.registry, win32.screens, win32.sysinfo, win32.whoami.

Files the agent reads

The full list of 264 paths, plus browser subpaths, registry keys and file patterns, is in target-paths.md in this gist. Main groups:

• SSH and remote access: ~\.ssh\* including known_hosts, PuTTY and WinSCP sessions in the registry, FileZilla sitemanager.xml and recentservers.xml
• GPG: %APPDATA%\gnupg, private-keys-v1.d
• AI tools: ~\.claude\.credentials.json, %APPDATA%\Claude\claude_desktop_config.json, $CODEX_HOME\auth.json, Gemini CLI oauth_creds.json, GitHub Copilot CLI, Cursor, Windsurf, VS Code (state.vscdb, mcp.json), Kimi, Qwen Code, OpenCode, Aider, Continue.dev
• Cloud: AWS (~\.aws\credentials, SSO cache), Azure, Google Cloud, Oracle Cloud, DigitalOcean, Hetzner, Linode, Alibaba, Tencent, Huawei, Fly.io, Railway, Vercel, Netlify, Cloudflare Wrangler, Supabase, Neon, PlanetScale, MongoDB Atlas, Snowflake, Databricks
• Developer tools: GitHub CLI hosts.yml, GitLab CLI, npm, pip, Poetry, Cargo, Composer, NuGet, RubyGems, Gradle, Maven, Docker and Podman auth.json, Kubernetes, Helm, Terraform, Pulumi, Stripe, Twilio, Sentry, Hugging Face, Kaggle
• Shell history: PowerShell ConsoleHost_history.txt, ~\.zsh_history, fish, psql
• Project folders: %USERPROFILE%\code, dev, source, Programming, Documents, Desktop, scanned for .env, appsettings*.json, application*.yml, docker-compose.yml, .mcp.json
• NIKKE: %APPDATA%\nikke_launcher, %APPDATA%\nikke_launcher_hmt
• Environment variables: 38 variables that point to config files, such as $CLAUDE_CONFIG_DIR, $GH_CONFIG_DIR, $AWS_SHARED_CREDENTIALS_FILE, $KUBECONFIG, $DOCKER_CONFIG
• Crypto wallets: 28 browser extensions by ID, including MetaMask, Phantom, Coinbase, Binance, OKX, Bybit, Bitget, Trust, Rabby, Rainbow, Keplr, Solflare, Backpack, Tonkeeper, TronLink, Xverse, UniSat, Petra, Ronin and Magic Eden

Infrastructure

Timeline (GMT)

Indicators of compromise

# Domains
insightjs.com
analytics.insightjs.com
insightjs.org

# IP
89.127.233.127

# URLs
https://insightjs.com/l.js?f=aegis
https://insightjs.com/l.js?f=images
https://insightjs.com/l.js?f=feedlist
https://analytics.insightjs.com/comm/assets/insight.bundle

# Modified official files
https://sg-gpts.playerinfinite.com/comm/assets/lib/aegis-fix.min.js
https://na-webassets.playerinfinite.com/comm/nikke_launcher/assets/images.7fec4c32.js
https://na-webassets.playerinfinite.com/comm/nikke_launcher/assets/FeedList.feb647c9.js

# Modified FeedList.feb647c9.js SHA-256
2f2aac505f486067af6831d6c75ea74df63acb1ed4e4002709c5962c68bd9203

# Payload SHA-256 (2026-11-03 16:22 GMT copy)
cc0ad05bfe85940a6067b3a72c182d3953339129206634141926d5d0b35973ec

# Log strings (Launcher/intl_service/debug.log)
startup already in progress
k2f_chan registered
adopted
resuming
agent started as
lua downloaded to log\tinyget\

# Agent state (Local Storage, survives deleting the NIKKE folder)
%APPDATA%\nikke_launcher\tbs_cache\Local Storage\leveldb\*.log containing k2f.agent.state

# Windows persistence (the PlatformExperienceHelper folder itself is normal Chrome; only the 64-hex subfolder with the DLL is malicious)
%LOCALAPPDATA%\Google\Chrome\User Data\PlatformExperienceHelper\\platform_experience_helper.dll
HKCU\Software\Classes\CLSID\{E77CC89B-7401-4C04-8CED-149DB35ADD04}\InprocServer32

# Temporary files
%TEMP%\k2f-bcreds-*
k2f_screen_*.jpg

For Level Infinite

• Three modified files on Tencent COS had last-modified Sep 27 2026, 06:41-06:42 GMT. aegis-fix.min.js and images.7fec4c32.js were replaced on Nov 3 at 17:04 and 17:21 GMT.
• FeedList.feb647c9.js was replaced at the origin on Oct 28 at 15:46 GMT, but 43.175.144.148 and 43.175.145.181 still served the Sep 27 copy on Nov 3 at 18:59 GMT, also for requests with a query string. Every CDN server needs a purge for this path, and the other paths should be checked on each server, not only on the one a given resolver returns.
• Players who launched since Sep 27 may still have the modified files in tbs_cache, so a forced cache reset in the next launcher update would help.
• The attacker had write access to the CDN bucket, or to the pipeline that publishes to it. That access has to be found and closed. Otherwise a new loader with a new domain can be pushed at any time.
• Other files in the same buckets may also be modified. They should be checked against build output.
• The decompiled payload, the decoded string table and a password-protected sample are available to Level Infinite, hosting providers and security researchers on request. They are not posted here because they would give anyone a working stealer.

NIKKE launcher payload: every target path

Decoded from insight.bundle (SHA-256 cc0ad05bfe85940a6067b3a72c182d3953339129206634141926d5d0b35973ec). ~ is %USERPROFILE%. $VAR paths are only used when that environment variable is set.

Files and folders (250)

$ARGOCD_CONFIG_DIR\config
$AZURE_CONFIG_DIR\accessTokens.json
$AZURE_CONFIG_DIR\msal_token_cache.bin
$AZURE_CONFIG_DIR\service_principal_entries.bin
$CARGO_HOME\credentials.toml
$CLAUDE_CONFIG_DIR\.claude.json
$CLAUDE_CONFIG_DIR\.credentials.json
$CLAUDE_CONFIG_DIR\settings.json
$CLOUDSDK_CONFIG\access_tokens.db
$CLOUDSDK_CONFIG\application_default_credentials.json
$CLOUDSDK_CONFIG\credentials.db
$CODEX_HOME\auth.json
$CODEX_HOME\config.toml
$COMPOSER_HOME\auth.json
$COPILOT_HOME\mcp-config.json
$DOCKER_CONFIG\config.json
$DSH_HOME\.credentials.yaml
$GEMINI_CLI_HOME\.gemini\oauth_creds.json
$GEMINI_CLI_HOME\.gemini\settings.json
$GH_CONFIG_DIR\hosts.yml
$GRADLE_USER_HOME\gradle.properties
$HELM_CONFIG_HOME\repositories.yaml
$HF_HOME\stored_tokens
$HF_HOME\token
$JFROG_CLI_HOME_DIR\jfrog-cli.conf.v6
$KAGGLE_CONFIG_DIR\access_token
$KAGGLE_CONFIG_DIR\kaggle.json
$KIMI_SHARE_DIR\config.toml
$PULUMI_HOME\credentials.json
$SAKURA_PROFILE_DIR\*\config.json
$SNOWFLAKE_HOME\config.toml
$TWILIO_CONFIG_DIR\config.json
$XDG_CONFIG_HOME\configstore\firebase-tools.json
~\.aider.conf.yml
~\.aliyun\config.json
~\.anyscale\credentials.json
%APPDATA%\age\*
%APPDATA%\Anthropic\credentials\*.json
%APPDATA%\atlascli\config.toml
%APPDATA%\Buildkite CLI\bk.yaml
%APPDATA%\Claude\claude_desktop_config.json
%APPDATA%\cloudsmith\credentials.ini
%APPDATA%\Code - Insiders\User\globalStorage\state.vscdb
%APPDATA%\Code - Insiders\User\settings.json
%APPDATA%\Code\User\globalStorage\**\*.json
%APPDATA%\Code\User\globalStorage\state.vscdb
%APPDATA%\Code\User\mcp.json
%APPDATA%\Code\User\profiles\*\mcp.json
%APPDATA%\Code\User\profiles\*\settings.json
%APPDATA%\Code\User\settings.json
%APPDATA%\Code\User\workspaceStorage\*\state.vscdb
%APPDATA%\Composer\auth.json
%APPDATA%\Cursor\User\globalStorage\**\*.json
%APPDATA%\Cursor\User\globalStorage\state.vscdb
%APPDATA%\Cursor\User\settings.json
%APPDATA%\dart\pub-credentials.json
%APPDATA%\dart\pub-tokens.json
%APPDATA%\doctl\config.yaml
%APPDATA%\FileZilla\recentservers.xml
%APPDATA%\FileZilla\sitemanager.xml
%APPDATA%\fish\fish_history
%APPDATA%\gcloud\access_tokens.db
%APPDATA%\gcloud\application_default_credentials.json
%APPDATA%\gcloud\credentials.db
%APPDATA%\GitHub CLI\hosts.yml
%APPDATA%\gnupg
%APPDATA%\go\env
%APPDATA%\hcloud\cli.toml
%APPDATA%\helm\repositories.yaml
%APPDATA%\Microsoft\UserSecrets\*\secrets.json
%APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
%APPDATA%\Mozilla\Firefox\Profiles
%APPDATA%\netlify\Config\config.json
%APPDATA%\nikke_launcher
%APPDATA%\nikke_launcher_hmt
%APPDATA%\npm\etc\npmrc
%APPDATA%\NuGet\NuGet.Config
%APPDATA%\octopus\cli_config.json
%APPDATA%\Opera Software\Opera Stable
%APPDATA%\pip\pip.ini
%APPDATA%\postgresql\pgpass.conf
%APPDATA%\postgresql\.pg_service.conf
%APPDATA%\postgresql\psql_history
%APPDATA%\pypoetry\auth.toml
%APPDATA%\rclone\rclone.conf
%APPDATA%\s3cmd.ini
%APPDATA%\terraform.d\credentials.tfrc.json
%APPDATA%\terraform.rc
%APPDATA%\Windsurf\User\globalStorage\**\*.json
%APPDATA%\Windsurf\User\globalStorage\state.vscdb
%APPDATA%\Windsurf\User\globalStorage\storage.json
%APPDATA%\Windsurf\User\settings.json
%APPDATA%\.wrangler\config\default.toml
%APPDATA%\xdg.data\com.vercel.cli\auth.json
~\.argocd\config
~\.aws\cli\cache\*.json
~\.aws\config
~\.aws\credentials
~\.aws\sso\cache\*.json
~\.aws\sso\cache\kiro-auth-token.json
~\.Azure\accessTokens.json
~\.Azure\msal_token_cache.bin
~\.Azure\service_principal_entries.bin
~\.b2_account_info
~\.bash_history
~\.bce\config.json
~\.cache\huggingface\stored_tokens
~\.cache\huggingface\token
~\.cargo\credentials
~\.cargo\credentials.toml
C:\buildkite-agent\buildkite-agent.cfg
C:\config.toml
~\.certs\*
C:\GitLab-Runner\config.toml
~\.circleci\cli.yml
~\.claude\.credentials.json
~\.claude.json
~\.claude\settings.json
~\\.cloudflared\\*
~\.cloudsmith\credentials.ini
~\.codeium\windsurf\mcp_config.json
~\.codex\auth.json
~\.codex\config.toml
~\.config\age\*
~\.config\argocd\config
~\.config\circleci\config.yml
~\.config\configstore\firebase-tools.json
~\.config\gh\hosts.yml
~\.config\git\config
~\.config\git\credentials
~\.config\glab-cli\config.yml
~\.config\linode-cli
~\.config\planetscale\access-token
~\.config\tc\config.yml
~\.config\tea\config.yml
~\.continue\assistants\*.yaml
~\.continue\config.json
~\.continue\config.yaml
~\.continuum\anaconda-client\tokens\*.token
~\.copilot\mcp-config.json
C:\Program Files\Jenkins\secrets\initialAdminPassword
~\.cursor\mcp.json
~\.databrickscfg
~\.dbt\profiles.yml
~\.docker\config.json
~\Documents\PowerShell\Microsoft.PowerShell_profile.ps1
~\Documents\PowerShell\profile.ps1
~\Documents\.Renviron
~\Documents\.Rprofile
~\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
~\Documents\WindowsPowerShell\profile.ps1
~\.dogrc
~\.dsh\.credentials.yaml
~\.expo\state.json
~\.fly\config.yml
~\.gem\credentials
~\.gemini\google_accounts.json
~\.gemini\oauth_creds.json
~\.gemini\settings.json
~\.gitconfig
~\.git-credentials
~\.gradle\gradle.properties
~\.hcloud\config.json
~\.jenkins\secrets\initialAdminPassword
~\.jfrog\jfrog-cli.conf
~\.jfrog\jfrog-cli.conf.v6
~\.kaggle\access_token
~\.kaggle\kaggle.json
~\.keys\*
~\.kimi\config.toml
~\.kimi\credentials\*.json
~\.kimi\mcp.json
~\.kube\config
%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data
%LOCALAPPDATA%\ContinuumIO\binstar\*.token
%LOCALAPPDATA%\glab-cli\config.yml
%LOCALAPPDATA%\Google\Chrome\Application
%LOCALAPPDATA%\Google\Chrome\User Data
%LOCALAPPDATA%\Google\Chrome\User Data\PlatformExperienceHelper
%LOCALAPPDATA%\Microsoft\Edge\User Data
%LOCALAPPDATA%\ngrok\ngrok.yml
%LOCALAPPDATA%\snowflake\config.toml
%LOCALAPPDATA%\snowflake\connections.toml
%LOCALAPPDATA%\Vivaldi\User Data
~\.local\share\fish\fish_history
~\.m2\settings.xml
~\mc\config.json
~\.modal.toml
~\.mysql_history
~\.ncloud\configure
~\.netrc
~\_netrc
~\.node_repl_history
~\.npmrc
~\.oci\*
~\.oci\config
~\.oraclebmc\config
~\.pg_service.conf
~\pip\pip.ini
%PROGRAMDATA%\gemini-cli\settings.json
%PROGRAMDATA%\Git\config
%PROGRAMDATA%\pip\pip.ini
%PROGRAMFILES%\Git\etc\gitconfig
~\.psql_history
~\.pulumi\credentials.json
~\.pypirc
~\.python_history
~\.qwen\.env
~\.qwen\settings.json
~\.railway\config.json
~\.rclone.conf
~\.rediscli_history
~\.runpod\config.toml
~\.s3cfg
~\.sbt\.credentials
~\.sbt\sonatype_central_credentials
~\.semgrep\settings.yml
~\.sentryclirc
~\.snowflake\config.toml
~\.snowflake\connections.toml
~\.snowsql\config
~\.sqlite_history
~\.ssh\
~\\.ssh\\*
~\.ssh\config
~\.supabase\access-token
~\.tccli\*.credential
%TEMP%\k2f-bcreds-
~\.terraform.d\credentials.tfrc.json
~\.terraformrc
~\.twilio-cli\config.json
~\.usacloud\*\config.json
%USERPROFILE%\code
%USERPROFILE%\.config\configstore\snyk.json
%USERPROFILE%\.config\containers\auth.json
%USERPROFILE%\.config\neonctl\credentials.json
%USERPROFILE%\.config\stripe\config.toml
%USERPROFILE%\.config\stripe\credentials.json
%USERPROFILE%\.config\.wrangler\config\default.toml
%USERPROFILE%\Desktop
%USERPROFILE%\dev
%USERPROFILE%\Documents
%USERPROFILE%\.local\share\opencode\auth.json
%USERPROFILE%\Programming
%USERPROFILE%\source
~\.vault-token
~\.volcengine\config.json
~\.yarnrc
~\.yarnrc.yml
~\.zsh_history

Environment variables read as a file path (16)

$AWS_CONFIG_FILE
$AWS_SHARED_CREDENTIALS_FILE
$B2_ACCOUNT_INFO
$BUILDKITE_AGENT_CONFIG
$DATABRICKS_CONFIG_FILE
$GOOGLE_APPLICATION_CREDENTIALS
$HELM_REPOSITORY_CONFIG
$HF_TOKEN_PATH
$MODAL_CONFIG_PATH
$NPM_CONFIG_USERCONFIG
$OCI_CONFIG_FILE
$PGPASSFILE
$PGSERVICEFILE
$PIP_CONFIG_FILE
$RCLONE_CONFIG
$TF_CLI_CONFIG_FILE

Browser profile subpaths (inside each Chrome/Edge/Brave/Vivaldi/Opera/Firefox profile) (17)

\ChatSessions\
\Cookies
\Extensions
\Extensions\
\IndexedDB\chrome-extension_
\key4.db
\Local Extension Settings\
\Local State
\Local Storage\leveldb
\Login Data
\Login Data For Account
\logins.json
\Network\Cookies
\private-keys-v1.d
\private-keys-v1.d\
\Skills-
\u%04x

Registry keys (7)

HARDWARE\DESCRIPTION\System\CentralProcessor\0
Software\Classes\CLSID\{E77CC89B-7401-4C04-8CED-149DB35ADD04}\InprocServer32
Software\GNU\GnuPG
Software\Martin Prikryl\WinSCP 2\Sessions
SOFTWARE\Microsoft\Windows NT\CurrentVersion
Software\SimonTatham\PuTTY\Sessions
SYSTEM\CurrentControlSet\Control\Session Manager\Environment

File names and extensions it looks for while scanning (39)

%0\x00
cloudformation.schema.json
codex-index-v1.json
config.ini
credentials
.db
diagnosticMessages.generated.json
docker-compose.yaml
docker-compose.yml
.env
.example
.git
hooks-index.json
inheritance.json
key4.db
kiro-auth-token.json
known_hosts
known_hosts.old
.ldb
.log
logins.json
.mcp.json
mcp.json
mcp_marketplace_catalog.json
.NET user-secrets
.old
old-clsid.txt
.package-lock.json
package-lock.json
%ProgramFiles%\Google\Chrome\Application
%ProgramFiles(x86)%\Google\Chrome\Application
%ProgramFiles(x86)%\NuGet\Config\NuGet.Config
%ProgramW6432%\Google\Chrome\Application
.sample
.sst
.template
toolEmbeddings.json
%XDG_CONFIG_HOME%\.semgrep\settings.yml
%XDG_CONFIG_HOME%\stripe\config.toml