NIKKE PC Launcher Compromised to Distribute Malware

The developers of Goddess of Victory: NIKKE confirmed that a third party tampered with scripts in the game’s PC launcher, distributing malware that could steal account credentials and cryptocurrency wallet data. The company said it issued a client update on November 4 at approximately 02:30 (UTC+9) and is investigating the impact.

Independent security researcher MotherSphere reported that four JavaScript files on publisher Level Infinite’s content delivery network were modified on September 27, 2026. The files allegedly downloaded code from attacker-controlled domains when players opened the launcher. BleepingComputer said its examination of two files found an obfuscated loader that retrieved and ran additional code.

MotherSphere’s analysis said the downloaded payload, named insight.bundle, installed a remote-access agent called K2F. It could execute commands, access local files, take screenshots, and collect NIKKE credentials and browser data. A separate Windows DLL could also steal recovery phrases and private keys from cryptocurrency wallet browser extensions, though it is unknown whether that component was deployed or whether any cryptocurrency was stolen.

The researcher said Level Infinite replaced three affected scripts on November 3, but a tampered version of the fourth was reportedly still available at 22:26 GMT. Level Infinite had not responded to BleepingComputer by publication. The publisher said it would provide further details in a separate notice.