Nikke PC launcher hacked to spread remote access and data-stealing malware

Level Infinite confirmed on November 4 that hackers tampered with PC launcher scripts for Goddess of Victory: NIKKE in a supply-chain attack, according to a notice the publisher posted on X. The company said it issued a client fix at 02:30 Korea Standard Time (17:30 UTC on November 3) and is still investigating the scope of impact. The notice reads: "We have identified an issue indicating that the PC Launcher's script files may have been tampered with by a third party".

What researchers found

Independent researcher MotherSphere said in a GitHub report that four JavaScript files on Level Infinite's official content delivery network were modified on September 27 to inject a loader that fetched further code from attacker-controlled domains insightjs[.]com and insightjs[.]org. BigGo Finance reported the modification time as 06:41 UTC. BleepingComputer examined two of the modified files and confirmed they held an obfuscated loader that fetched and ran code from those domains, trying the second if the first did not respond.

MotherSphere's analysis says the downloaded code abused the launcher's native functions to run a LuaJIT payload named insight.bundle and install a remote-access agent called K2F. The backdoor let attackers run commands, view and download local files, take screenshots, gather NIKKE account credentials, and take data stored in web browsers. BleepingComputer found strings in a sample uploaded to VirusTotal that point to wallet-data theft from extensions like MetaMask, Phantom and Coinbase Wallet, including recovery phrases and private keys. Whether attackers deployed that component or successfully stole cryptocurrency is unknown.

Timeline and company response

MotherSphere's report says Level Infinite replaced three of the four compromised files between 17:04 and 17:21 UTC on November 3, but a tampered copy of the fourth was still being served as of 22:26 UTC. BigGo Finance reported that the attackers' server stopped responding at 18:31 UTC on November 3, and Level Infinite's Japanese account disclosed the possible tampering at 03:14 UTC on November 4. BleepingComputer found that the backup domain insightjs[.]org now serves a warning inside the launcher in English, Chinese, Japanese and Korean telling players to close the launcher until the publisher confirms a fix; the message says it is not an official announcement, and it is unclear who controls the domain.

What defenders should check

MotherSphere said all users who ran the NIKKE PC launcher from October 24 onward are at risk, and that infected machines will not recover on their own even after the server files are swapped. The researcher advised stopping the launcher, changing browser passwords, and transferring API keys and cryptocurrency wallets to fresh addresses. BigGo Finance noted there is no disclosed number of infected users or confirmed thefts, and no evidence the same malware hit other Tencent-published games on the same CDN. For detection, the string k2f_chan registered in Launcher/intl_service/debug.log indicates the Lua agent executed, though it does not confirm the DLL loaded. BleepingComputer recommends a full antivirus scan, and for compromised machines a Windows reinstall and credential changes from a clean device. BigGo Finance adds that users should delete the cache at %APPDATA%\nikke_launcher\tbs_cache before running the game again, and that the mobile version is unaffected.