Developers of Goddess of Victory: NIKKE have confirmed that attackers modified the game’s PC launcher scripts in a supply chain attack, potentially exposing players to malware capable of stealing account credentials, browser data, and cryptocurrency wallet information. The publisher issued a client update on November 4 at approximately 02:30 UTC+9 and said it is still investigating the incident’s scope.
In a notice published on X, the company said, “We have identified an issue that indicates the PC Launcher script file may have been modified by a third party.” The company added that it was investigating the impact and would provide further details in a separate communication. Read the statement on X.
Malicious code delivered through the game launcher
Goddess of Victory: NIKKE is a science-fiction shooting role-playing game developed for Windows by South Korean company Shift Up. It is also available for iOS and Android.
Its publisher, Level Infinite, reports 45 million downloads since the game’s launch in 2022, including 10 million downloads on Google Play alone.
Level Infinite has not disclosed many technical details. However, independent security researcher MotherSphere said the incident involved four JavaScript files hosted on Level Infinite’s official content delivery network. MotherSphere’s report is available on GitHub.
According to the analysis, one or more files were modified on September 27, 2026, to inject JavaScript that downloaded additional code from attacker-controlled servers whenever a player opened the game launcher. The injected code was concealed inside legitimate JavaScript files, with obfuscation used to hide the domains insightjs[.]com and insightjs[.]org.
BleepingComputer examined two of the modified files and found obfuscated loaders designed to retrieve and execute further code from those domains. The loader could use the second domain if the first one was unavailable.
MotherSphere said the downloaded code abused the launcher’s native functionality to retrieve and execute a malicious LuaJIT payload named insight.bundle and install a remote access tool called K2F.
Backdoor could steal credentials and wallet data
The backdoor allowed attackers to execute commands remotely, browse and download files, capture screenshots, collect NIKKE account credentials, and extract information stored in web browsers.
It also supported installing a malicious Windows DLL named platform_experience_helper.dll. The DLL may have remained active after the game launcher was closed.
BleepingComputer analyzed strings extracted from uploaded DLL samples and found code indicating that the malware could target cryptocurrency wallet data stored in browser extensions, including MetaMask, Phantom, and Coinbase Wallet. The sample is available on VirusTotal.
The DLL could intercept sensitive wallet information, including recovery phrases and private keys, potentially enabling cryptocurrency theft. It remains unclear whether the attackers deployed this additional component on infected systems or successfully stole cryptocurrency from players.
Compromised scripts and warning message
Researchers said Level Infinite replaced three affected JavaScript files with clean versions on November 3. However, they reported that a fourth tampered file was still being served to users at 22:26 Japan time. This suggests that at least one compromised script may have remained accessible after the client update was released.
Researchers also published indicators of compromise that players can use to check whether the malicious Lua agent ran on their computers. One indicator is the string k2f_chan registered in Launcher/intl_service/debug.log within the NIKKE installation directory. The entry indicates that the malicious Lua agent was executed, but does not confirm whether the DLL was loaded.
BleepingComputer found that insightjs[.]org, described as a backup domain, was later serving code that displayed a security warning inside the game launcher. The warning appeared in English, Chinese, Japanese, and Korean, telling players to close the launcher immediately and avoid opening the PC client until the publisher confirmed that the issue had been resolved.
Source: BleepingComputer
The warning is not an official announcement from the game’s publisher. It is unclear who currently controls the domain or when the malicious payload was replaced with the warning message.
BleepingComputer contacted Level Infinite about MotherSphere’s findings but did not receive a response before publication.
What affected players should do
Players who may have opened the PC launcher during the affected period should run a full system scan using up-to-date antivirus software. Anyone who believes their computer was compromised should reinstall Windows and change passwords and other sensitive credentials from a clean device.
Source: www.bleepingcomputer.com