NIKKE PC game launcher hacked to spread malware and steal data

The developers of the popular game Goddess of Victory: NIKKE have officially confirmed a security incident involving their PC game launcher. Hackers tampered with the launcher's script files in a supply-chain attack, utilizing the distribution channel to spread malicious software capable of stealing user credentials and cryptocurrency wallet data.

• Hackers injected malicious code into JavaScript files hosted on the official CDN.
• The deployed malware steals account credentials and browser-based crypto wallet data.
• Publisher Level Infinite rolled out a client update on November 4 to fix the issue.

Attack details and infiltration mechanism

According to independent security researcher MotherSphere, the attack involved four JavaScript files hosted on Level Infinite's content delivery network. The modified files utilized obfuscation to hide domains from which additional malicious payloads were downloaded whenever players opened the launcher. The injected code abused native functionality to retrieve and execute a LuaJIT payload named insight.bundle, deploying a remote access agent known as K2F.

This backdoor allowed attackers to execute remote commands, browse local files, capture screenshots, and harvest account credentials. Furthermore, analysis of a Windows DLL sample named platform_experience_helper.dll revealed functionality designed to steal cryptocurrency wallet data, recovery phrases, and private keys from browser extensions such as MetaMask, Phantom, and Coinbase Wallet.

Publisher response and user safety

Publisher Level Infinite issued a client update on November 4 at approximately 02:30 UTC+9 to address the vulnerability and replace the compromised files with clean versions. However, the researcher noted that at least one tampered script remained accessible for some time after the deployment.

Potentially affected players are advised to run a full system scan using up-to-date antivirus software. Those who confirm a compromise should reinstall Windows and update all sensitive credentials and passwords from a clean, uninfected device to ensure complete security.