NIKKE PC Launcher Compromised in Supply-Chain Attack That Installed Data-Stealing Malware

The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data. In a statement published on X, the company said it identified an issue indicating that the PC Launcher's script files may have been tampered with by a third party. Client fixes and an update were implemented on November 4 at approximately 02:30 (UTC+9). The company said it is currently investigating the scope of the impact and will provide further details on follow-up measures in a separate notice. Goddess of Victory: NIKKE is a popular sci-fi shooter RPG developed by the South Korean firm Shift Up for Windows, iOS, and Android. Its publisher, Level Infinite, has reported more than 45 million downloads since the game launched in 2022, while Google Play alone reports 10 million downloads. Although Level Infinite has not disclosed many details, a report on GitHub by independent security researcher MotherSphere alleges the incident involved four JavaScript files hosted on Level Infinite's official content delivery network. According to the researcher, the files were modified on September 27, 2026, to inject malicious JavaScript that downloaded additional code from attacker-controlled servers whenever players opened the game launcher. The injected code was hidden within legitimate files and used obfuscation to conceal the domains insightjs[.]com and insightjs[.]org, from which the malicious code was downloaded. BleepingComputer examined two of the modified JavaScript files and confirmed they contained an obfuscated loader designed to retrieve and execute additional code from those domains, falling back to the second domain if the first was unavailable. According to MotherSphere's analysis, the downloaded code abused the launcher's native functionality to retrieve and execute a malicious LuaJIT payload called insight.bundle, which installed a remote-access agent referred to as K2F. The backdoor allowed attackers to remotely execute commands, browse and download local files, capture screenshots, collect NIKKE account credentials, and steal information stored in web browsers. The malware also supported an additional command to install a malicious Windows DLL named platform_experience_helper.dll that could remain active after the game launcher was closed. Analysis of strings extracted from a DLL sample uploaded to VirusTotal found code indicating the malware can steal cryptocurrency wallet data from browser extensions, including MetaMask, Phantom, and Coinbase Wallet, potentially intercepting recovery phrases and private keys. It remains unknown whether that component was deployed on infected systems or whether cryptocurrency was successfully stolen. MotherSphere claims Level Infinite replaced three of the impacted JavaScript files with clean versions on November 3, but that a tampered copy of the fourth was reportedly still being served to users as of 22:26 GMT, suggesting at least one compromised script may have remained accessible after the client update was deployed. The researcher also shared indicators of compromise, including the string k2f_chan registered in the Launcher/intl_service/debug.log file within the NIKKE installation directory, which indicates the malicious Lua agent executed but does not confirm whether the DLL was loaded as well. Separately, BleepingComputer found that the backup domain insightjs[.]org is now serving code that displays a security warning inside the game launcher. The warning, displayed in English, Chinese, Japanese, and Korean, tells players to immediately close the launcher and refrain from opening the PC client until the publisher confirms the issue has been resolved. The message states that it is not an official announcement from the game's publisher, and it is unclear who currently controls the domain or when the malicious payload was replaced with the warning. BleepingComputer contacted Level Infinite for comment on the researcher's findings but had not received a response by publication. Potentially affected players are advised to run a full system scan using updated antivirus software. Those who find they were compromised should reinstall Windows and change passwords and other sensitive credentials from a clean device.