NIKKE PC launcher attack exposed players to credential-stealing malware
A tampered Windows launcher reportedly delivered a remote-access backdoor; players should follow NIKKE’s manual security checks before opening it.
The developers of GODDESS OF VICTORY: NIKKE say attackers tampered with scripts used by the game's Windows launcher, turning a routine update path into a supply-chain attack. The incident could expose players to a remote-access backdoor capable of stealing account credentials, browser data and cryptocurrency-wallet information.
The publisher issued a security notice on 4 November, saying it had identified third-party tampering in the PC launcher's script files and had deployed client fixes at about 02:30 UTC+9. It said the scope of the impact was still under investigation. 1
What happened to the NIKKE launcher
BleepingComputer reports that an independent researcher found malicious JavaScript inserted into files hosted on an official Level Infinite content-delivery network. The altered files reportedly downloaded further code from attacker-controlled domains when players opened the launcher. 2
The downloaded payload allegedly used the launcher's native functionality to retrieve and run a malicious LuaJIT component known as insight.bundle. That component installed a remote-access agent called K2F, which could execute commands, browse and download local files, capture screenshots and collect NIKKE credentials.
The investigation also identified a Windows DLL that could remain active after the launcher closed. Analysis of the sample found functionality aimed at browser cryptocurrency-wallet extensions, including MetaMask, Phantom and Coinbase Wallet. That does not prove that cryptocurrency was stolen from players, and the publisher has not said how many systems were affected.
What players should do
The researcher said Level Infinite replaced three compromised JavaScript files on 3 November, although a fourth was reportedly still being served later that day. The official NIKKE site has since published manual security-check instructions for the PC launcher, alongside advice tied to the incident. 1
Players should avoid opening the Windows launcher until they have checked the latest official guidance. If the launcher was opened during the suspected exposure window, run a full scan with updated security software and check the installation logs for the indicator `k2f_chan`. Anyone who finds signs of compromise should change sensitive passwords from a clean device and consider a Windows reinstall rather than trusting a potentially infected installation.
The incident is a useful reminder that game launchers are software supply chains, not harmless menus. Even when a publisher pushes a fix quickly, the launcher itself is the mechanism delivering that fix — which makes clear incident updates and practical checking tools more important than a vague “update now” message.
Our opinion
NIKKE players need a precise account of what was changed, which launcher versions were exposed and whether any stolen data has been confirmed. The official notices establish the incident and the response, while the technical investigation explains the possible capabilities of the payload. Until the publisher publishes a fuller impact assessment, players should treat the situation as a genuine compromise risk rather than assume that installing the latest client automatically cleans every affected machine.