A serious cybersecurity incident has hit Goddess of Victory: NIKKE after attackers compromised files used by the game’s official PC launcher. The attack potentially exposed players to remote-access malware capable of stealing passwords, browser data and sensitive files — all through software they trusted.
For PC gamers, downloading games through official launchers is generally considered safer than installing software from unknown websites. But a recent security breach involving Goddess of Victory: NIKKE demonstrates that even legitimate gaming infrastructure can become a delivery system for malicious software.
Publisher Level Infinite has confirmed that third parties tampered with JavaScript files used by the game’s Windows launcher, creating a potential route for malware to execute on players’ computers.
The company has released fixes, introduced a security-check feature and apologised to affected players. However, the full extent of the incident remains under investigation.
How Hackers Compromised the NIKKE Launcher
The incident involved a supply-chain attack — a method in which attackers compromise a trusted component or service rather than directly targeting every victim.
According to Level Infinite’s official incident timeline, attackers hijacked the insightjs.com domain on September 27, 2026.
Later that day, JavaScript files used by the NIKKE PC launcher were modified through the compromised domain.
The malicious scripts were distributed through infrastructure associated with the legitimate game launcher, meaning players did not need to download a suspicious third-party application to encounter the threat.
The publisher says distribution of malicious programs to players’ PCs began on October 30.
On November 4, Level Infinite detected abnormalities and began replacing the affected files. Its response included refreshing content delivery network caches to prevent compromised scripts from continuing to reach users.
Malware Could Give Attackers Remote Access to Gaming PCs
Independent security research identified a malicious component known as K2F, described as a remote-access agent.
According to technical findings reported by BleepingComputer, the malware supported several dangerous capabilities:
- Executing commands remotely on an infected computer.
- Browsing and downloading local files.
- Capturing screenshots.
- Accessing NIKKE account credentials.
- Collecting information stored in web browsers.
- Potentially stealing cryptocurrency wallet information.
Researchers also identified a malicious Windows DLL named platform_experience_helper.dll, designed to provide persistence through the Chrome browser environment.
This means the attack potentially extended beyond the game itself.
A compromised PC could expose email accounts, gaming accounts, saved browser credentials and other personal information.
However, the existence of these malware capabilities does not establish that every potentially exposed player was infected or that all forms of data theft occurred.
Cryptocurrency Wallets Were Also Targeted
One particularly concerning finding involved cryptocurrency wallet extensions.
Analysis of a malicious DLL revealed functionality associated with collecting sensitive wallet information from browser extensions, including MetaMask, Phantom and Coinbase Wallet.
Such information can include private keys and recovery phrases, which may allow an attacker to take control of cryptocurrency assets.
At the time of reporting, investigators had not established whether attackers successfully deployed this component to every affected system or how much cryptocurrency, if any, had been stolen.
The distinction matters: researchers identified the malware’s capabilities, but the full real-world impact is still being investigated.
Timeline: From September Compromise to November Discovery
Level Infinite has provided a timeline explaining how the incident unfolded.
| Date | Incident |
|---|---|
| September 27, 2026 | Third parties hijacked the insightjs.com domain |
| September 27, 2026 | Launcher JavaScript files were tampered with |
| October 30, 2026 | Malicious software distribution began |
| November 4, 2026 | Level Infinite detected suspicious launcher activity |
| November 4, 2026 | Compromised scripts were replaced and CDN caches refreshed |
| November 5, 2026 | A security-check and malware-removal feature became available |
The timeline highlights an important detail: malicious launcher modifications existed for more than a month before the publisher detected the incident, although its investigation places the start of malware distribution on October 30.
Which NIKKE Players Should Be Concerned?
According to the publisher, anyone who launched the Windows PC client at least once after September 27 at 15:41 (UTC+9) should perform a security check.
This does not mean every player who opened the launcher was infected.
Instead, the company is recommending precautionary checks because affected systems may have encountered compromised launcher resources during that period.
Level Infinite says the incident was limited to the PC launcher and did not affect the mobile version of the game.
Players who exclusively used the mobile version do not need to perform the incident-specific PC checks.
How to Check Whether Your PC Was Compromised
Level Infinite introduced a security feature into the official PC client on November 5 to detect and remove malware associated with the incident.
The publisher also published manual inspection instructions.
However, players who want to preserve evidence of a possible infection should take precautions before launching the updated client.
Independent researchers have warned that the updated launcher’s cleanup process can remove logs and other evidence useful for determining whether malware executed.
A relevant indicator is the following entry in the launcher’s Launcher/intl_service/debug.log file:
k2f_chan registered
According to the security research, this entry indicates that the malicious Lua agent executed. It does not, by itself, prove that the additional Chrome-targeting DLL was installed.
The absence of this entry also does not guarantee that a computer is safe, because launcher logs may be overwritten.
Players should consult the publisher’s latest security instructions and consider preserving relevant logs before using the automatic cleanup feature.
What Players Should Do Right Now
If you launched the affected PC client during the identified period, take the incident seriously even if your computer appears to be functioning normally.
1. Check the official security announcement.
Follow Level Infinite’s published instructions for identifying and removing malicious components. Avoid downloading unofficial cleanup tools from unverified websites.
2. Preserve evidence if you suspect an infection.
If you may need to determine whether your PC was compromised, preserve relevant launcher logs before allowing automatic cleanup.
3. Run a full antivirus scan.
Update Microsoft Defender or another reputable security product and perform a full system scan. Consider an offline scan for additional protection.
4. Change important passwords from a clean device.
Prioritise email, gaming accounts, financial services and accounts with passwords saved in your browser.
5. Revoke active sessions and access tokens.
Stolen browser cookies may allow attackers to access accounts without knowing their passwords. Sign out of active sessions where possible and revoke exposed API keys or authentication tokens.
6. Protect cryptocurrency wallets.
If wallet recovery phrases or private keys may have been exposed, treat them as compromised. Moving assets to a newly created wallet using a new recovery phrase may be necessary.
7. Consider reinstalling Windows if compromise is confirmed.
Because the malicious agent reportedly supported remote command execution, antivirus cleanup alone cannot guarantee that an attacker made no additional changes. A clean Windows installation may be the safest recovery option for a confirmed compromise.
Level Infinite Responds and Promises Stronger Security
Following the incident, Level Infinite apologised to players and acknowledged that its security protections had failed to prevent the attack.
The publisher announced plans to improve monitoring, introduce stronger integrity verification for external resources and review the permissions assigned to launcher components.
These measures are intended to make unauthorised changes easier to detect and reduce the potential impact of future compromises.
The company is also investigating possible damage to external accounts and financial assets, encouraging affected players to contact customer support.
Why This Attack Matters Beyond NIKKE
The NIKKE incident highlights a broader cybersecurity problem in PC gaming.
Game launchers frequently download scripts, updates and other resources from external servers. When those resources are compromised, attackers may be able to reach users through software they already trust.
This is especially concerning because gaming PCs often contain far more than game files.
They may store browser sessions, passwords, payment information, work documents, developer credentials and cryptocurrency wallets.
An attacker who gains remote access to such a system may have opportunities to compromise multiple accounts and services.
The attack also demonstrates why supply-chain security matters for game publishers. Protecting the main game executable is not enough if external resources loaded by the launcher can be modified.
Final Thoughts
The compromise of the Goddess of Victory: NIKKE PC launcher is a reminder that even official gaming software can become a cybersecurity threat when trusted infrastructure is breached.
Level Infinite has implemented fixes and introduced a malware-checking feature, but players who used the Windows launcher during the affected period should still verify their systems and protect their accounts.
The number of infected players and the full extent of any stolen information have not yet been established publicly.
For the gaming industry, the lesson is clear: launcher security is not simply about preventing cheats or protecting game files. It is also about protecting the computers, identities and personal information of the people who play.
Sources
