Goddess Victory Nikke launcher hacked, malware distributed
Players of the popular sci-fi shooter RPG Goddess of Victory: Nikke are facing a significant security threat after the game’s PC launcher was compromised in a sophisticated supply-chain attack.
The incident, which came to light on November 3, 2026, allowed malicious code to be distributed through developer Level Infinite’s official content delivery network (CDN), installing a powerful remote-access agent capable of stealing sensitive user data, including cryptocurrency wallet details and login credentials.
A stealthy supply-chain compromise targets Goddess Victory Nikke launcher players
The security breach impacts players who accessed the PC launcher from October 24, 2026, onwards, before fixes were fully implemented. While publisher Level Infinite and developer Shift Up have rolled out updates, the wide-ranging capabilities of the malware mean that potentially millions of players on Windows, Linux, and Steam Deck could have been exposed.
The attack began far earlier than its public discovery. Malicious code was secretly injected into four JavaScript files hosted on Level Infinite’s official CDN servers on September 27, 2026. These files, critical to the launcher’s operation, were modified between 6:41 and 6:42 GMT that day, laying the groundwork for the ensuing data theft.
From October 24, 2026, the compromised launcher started actively installing a remote-access agent onto players’ computers. Users began reporting unauthorized malware installations between October 31 and November 3, 2026, leading to a public warning in the Nikke community Discord at 16:11 GMT on November 3.
Independent security researcher MotherSphere published a detailed incident analysis report on GitHub the same day, outlining the mechanics of the attack. It revealed how attackers infiltrated a Level Infinite CDN server and modified the JavaScript files, enabling the download of additional malicious code from external domains like insightjs[.]com and insightjs[.]org.
This downloaded code then abused the launcher’s native functionality to execute a malicious LuaJIT payload, named insight.bundle. This payload was responsible for installing the persistent remote-access agent, referred to as K2F, giving attackers deep control over infected machines. This type of security breach highlights ongoing vulnerabilities in game distribution platforms and digital infrastructure.
Extensive data theft capabilities exposed
The K2F remote access tool granted attackers extensive capabilities, allowing them to remotely execute commands, browse and download local files, and capture screenshots from victims’ computers. The malware was designed for serious data exfiltration, targeting a broad spectrum of sensitive personal and financial information.
Crucially, the malware could steal saved browser passwords, session cookies, and login credentials from major web browsers, including Chrome, Edge, Firefox, Brave, and Opera. It also targeted private keys and seed phrases for at least 28 types of cryptocurrency wallets, such as MetaMask, Phantom, and Coinbase Wallet, representing a direct threat to users’ digital assets.
Beyond personal credentials, the threat extended to developer-specific data. The malware was confirmed to steal NIKKE account authentication tokens and developer API keys, alongside SSH security keys and cloud access credentials. This capability could potentially lead to further supply-chain compromises or unauthorized access to other services.
For persistent access, the malware included Windows-specific persistence hooks. These would inject into Google Chrome background processes, ensuring the backdoor remained active even after the game client was closed. Additionally, it could install a malicious Windows DLL named platform_experience_helper.dll to maintain its presence on the system.
Developer response and ongoing investigation
As news of the compromise spread, Level Infinite quickly moved to address the issue. On November 3, 2026, three of the four compromised JavaScript files were replaced with clean versions between 17:04 and 17:23 GMT.
The fourth file, FeedList.feb647c9.js, had been cleaned at its origin server on October 28, but some CDN servers continued to serve the malicious copy until November 4, 2026, between 03:12 and 03:21 GMT.
Level Infinite officially confirmed the issue and rolled out client fixes and an update on November 4, 2026, at approximately 02:30 (UTC+9). By 11:20 GMT on November 4, all four files were verified clean across the checked CDN servers. The company stated it is investigating the full scope of the impact and promised to provide further details regarding follow-up measures.
This incident occurred coincidentally around the game’s 4th-anniversary update on October 29, 2026, a period of heightened player engagement. The fact that Level Infinite’s PC launcher is shared by other titles, such as Delta Force, Honor of Kings, and PUBG Mobile, raises concerns. There’s worry that these other popular games might also have been exposed to similar vulnerabilities, although no official confirmation has been made.
Protecting your account: user recommendations
Given the severity of the attack, players who launched the PC version of Goddess of Victory: Nikke from October 24, 2026, onwards are advised to take immediate precautionary measures. The mobile version of the game is not believed to be affected, according to initial analyses.
Users can check for potential infection by:
- Opening
<your install drive>\NIKKE\Launcher\intl_service\debug.login Notepad and searching fork2f_chan. - Running the PowerShell command
reg query "HKCU\Software\Classes\CLSID\{E77CC89B-7401-4C04-8CED-149DB35ADD04}\InprocServer32". An “Unable to find” response indicates a clean system.
If you suspect an infection or wish to take proactive steps, it’s crucial to act swiftly. First, close the game launcher and disconnect your PC from the internet to prevent further data exfiltration. Then, change all your passwords from a clean device, prioritizing email accounts, and enable two-factor authentication (2FA) wherever possible.
Level Infinite suggests uninstalling the PC client by ending all “NIKKE” processes in Task Manager, deleting the NIKKE install folder, and removing %APPDATA%\nikke_launcher. Deleting %APPDATA%\nikke_launcher\tbs_cache before reopening the launcher is also a recommended step. Players should avoid using the PC client until Level Infinite officially confirms its complete security.
Broader implications for game security
The Nikke launcher hack serves as a stark reminder of the escalating threat posed by supply-chain attacks in the digital world. These attacks exploit the trust users place in third-party software and distribution networks, making them particularly insidious and difficult to detect. This incident echoes other major breaches like SolarWinds and the 3CX Desktop App Attack.
The gaming industry, with its reliance on launchers, frequent updates, and vast player bases, presents a fertile ground for such compromises. Past incidents, including malware-laced games on platforms like Steam and trojanized components for Windows and Android games, highlight a persistent vulnerability. The attack on Nikke emphasizes the need for developers and publishers to implement robust code-signing verification and real-time integrity checks across their infrastructure.
For players, the event underscores the importance of cybersecurity hygiene. While developers bear primary responsibility for securing their systems, users must remain vigilant, utilize strong passwords, enable 2FA, and consider security practices for their cryptocurrency investments.
The ongoing investigation by Level Infinite will hopefully provide further insights, but the incident already stands as a critical lesson in protecting digital assets in the evolving landscape of online gaming. Even platforms like Itch.io have expanded filters to combat malicious content.
As the gaming industry continues its rapid expansion, the sophistication of attacks like the one against Goddess of Victory: Nikke’s PC launcher is likely to grow. This makes ongoing vigilance, transparent communication from developers, and proactive security measures from both sides absolutely essential to safeguard player data and maintain trust within the gaming community.