NIKKE PC game launcher hacked to spread remote access, data-stealing malware
The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data.
The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data.
According to a notice published on X, a client update was issued on November 4 at 02:30 (UTC +9) to address the issue; accordingly, client fixes and an update were implemented on November 4 at about 02:30 (UTC+9).
Its publisher, Level Infinite, reported more than 45 million downloads since its launch in 2022, while Google Play alone reports 10 million downloads.
Although Level Infinite has not disclosed many details, a report on GitHub by independent security researcher MotherSphere alleges the incident involved four JavaScript files hosted on Level Infinite's official content delivery network (CDN).
BleepingComputer examined two of the modified JavaScript files and confirmed that they contained an obfuscated loader designed to retrieve and execute further code from these domains, falling back to the second domain if the first was unavailable.
According to the researcher, the files were modified on September 27, 2026, to inject malicious JavaScript that downloaded more code from attacker-controlled servers whenever players opened the game launcher.
The backdoor allowed attackers to remotely execute commands, browse and download local files, capture screenshots, collect NIKKE account credentials, and steal information stored in web browsers.
We are currently investigating the scope of the impact caused by this issue, and we will provide further details regarding follow-up measures in a separate notice. Goddess of Victory: NIKKE is a popular sci-fi shooter RPG developed by the South Korean firm Shift Up for Windows, iOS , and Android .
According to MotherSphere's analysis, the downloaded code abused the launcher's native functionality to retrieve and execute a malicious LuaJIT payload called insight.bundle, which installed a remote-access agent referred to as K2F.
The injected code was hidden within legitimate JavaScript files and used obfuscation to conceal the domains insightjs[.]com and insightjs[.]org , from which the malicious code was downloaded.
The malware also supported an further command to install a malicious Windows DLL named platform_experience_helper.dll that could remain active after the game launcher was closed.
However, it is unknown whether the attackers deployed this more component on infected systems or successfully stole cryptocurrency from players.
This suggests that at least one compromised script may have remained accessible after the company deployed its client update.
The researcher also shared indicators of compromise (IOCs) that users can check to determine whether the malicious Lua agent executed on their computers.
What happened
The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data.
According to a notice published on X, a client update was issued on November 4 at 02:30 (UTC +9) to address the issue; accordingly, client fixes and an update were implemented on November 4 at about 02:30 (UTC+9).
What changed
Its publisher, Level Infinite, reported more than 45 million downloads since its launch in 2022, while Google Play alone reports 10 million downloads.
Although Level Infinite has not disclosed many details, a report on GitHub by independent security researcher MotherSphere alleges the incident involved four JavaScript files hosted on Level Infinite's official content delivery network (CDN).
BleepingComputer examined two of the modified JavaScript files and confirmed that they contained an obfuscated loader designed to retrieve and execute further code from these domains, falling back to the second domain if the first was unavailable.
Who is affected
According to the researcher, the files were modified on September 27, 2026, to inject malicious JavaScript that downloaded more code from attacker-controlled servers whenever players opened the game launcher.
The backdoor allowed attackers to remotely execute commands, browse and download local files, capture screenshots, collect NIKKE account credentials, and steal information stored in web browsers.
Why it matters
We are currently investigating the scope of the impact caused by this issue, and we will provide further details regarding follow-up measures in a separate notice. Goddess of Victory: NIKKE is a popular sci-fi shooter RPG developed by the South Korean firm Shift Up for Windows, iOS , and Android .
According to MotherSphere's analysis, the downloaded code abused the launcher's native functionality to retrieve and execute a malicious LuaJIT payload called insight.bundle, which installed a remote-access agent referred to as K2F.
Technical details
The injected code was hidden within legitimate JavaScript files and used obfuscation to conceal the domains insightjs[.]com and insightjs[.]org , from which the malicious code was downloaded.
The malware also supported an further command to install a malicious Windows DLL named platform_experience_helper.dll that could remain active after the game launcher was closed.
Response
However, it is unknown whether the attackers deployed this more component on infected systems or successfully stole cryptocurrency from players.
This suggests that at least one compromised script may have remained accessible after the company deployed its client update.
What security teams should do
The researcher also shared indicators of compromise (IOCs) that users can check to determine whether the malicious Lua agent executed on their computers.
BleepingComputer has contacted Level Infinite for comment on MotherSphere's findings, but has not received a response by publication.
What remains unknown
Although Level Infinite has not disclosed many details, a report on GitHub by independent security researcher MotherSphere alleges the incident involved four JavaScript files hosted on Level Infinite's official content delivery network (CDN).
However, it is unknown whether the attackers deployed this more component on infected systems or successfully stole cryptocurrency from players.
The message confirms that this is not an official announcement from the game's publisher, so it unclear who currently controls the domain or when the malicious payload was replaced with the warning.
Attribution
BleepingComputer: The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.