NIKKE Game Launcher Compromised to Distribute Data-Stealing Malware

Attack Details

Developers of the game Goddess of Victory: NIKKE have confirmed that the PC version's game launcher was subjected to a supply-chain attack, where the launcher's script files were tampered with to distribute malware. The publisher, Level Infinite, released a security update on November 4, 2026, to address the vulnerability after the tampering was discovered.

How the Malware Works

According to an analysis by security researcher MotherSphere, the attack involved modifying four JavaScript files hosted on the publisher's Content Delivery Network (CDN). These files were injected with malicious code that downloads an additional payload from attacker-controlled servers when the game is launched. The attackers used obfuscation techniques to hide the domains used to download the code.

This code leads to the installation of a remote access agent known as K2F, which grants the attackers broad privileges including:

• Executing remote commands.
• Browsing and downloading local files.
• Taking screenshots.
• Stealing game account credentials and browser information.
• Installing a malicious DLL file (platform_experience_helper.dll) capable of stealing data from cryptocurrency wallets such as MetaMask and Phantom.

What This Means for Users

This attack poses a significant risk to NIKKE players, as the malware is capable of remaining active even after the game launcher is closed. Reports indicate that some of the modified files remained available for download even after the company's attempts to address the issue, raising questions about the actual scope of the impact.

Security Recommendations for Affected Users:

• Perform a full system scan using updated antivirus software.
• If an infection is confirmed, it is recommended to perform a clean reinstallation of the Windows operating system.
• Change all passwords and sensitive credentials from a different, clean device.
• Check for Indicators of Compromise (IOCs) such as the presence of the string k2f_chan in the log file Launcher/intl_service/debug.log within the game installation folder.