Back Biz.Chosun

Hacked Nikke PC launcher spreads RAT, steals accounts and crypto data

Biz.Chosun • November 4, 2026

Signs of malware distribution have been found in the PC launcher for the game "Goddess of Victory: Nikke."

According to a technical report published on GitHub on the 4th, four JavaScript files registered on the content delivery network (CDN) of Tencent's game publishing brand Level Infinite were tampered with by an unidentified attacker on Sept. 27.

Goddess of Victory: Nikke is a mobile game developed by SHIFT UP, a Korean game company, and published by Tencent, released in 2022, and the PC version has also been supported through a launcher developed and serviced by Tencent.

The report said that when a user runs the PC launcher, the tampered CDN script executes and can download and run remote access trojan (RAT) malware from an external server controlled by the attacker.

If infected with the malware, the attacker can execute arbitrary commands on the user's PC or install additional malware. It was also analyzed that account information saved in web browsers, application programming interface (API) keys, authentication tokens, and virtual asset wallet data can be stolen.

The report's poster said that all users who have run the Nikke PC launcher since Oct. 24 are at risk of infection. The poster also said that until there is an official response, users should stop running the Nikke PC launcher and perform response measures to remove the malware.

The poster added that all account passwords saved in the browser should be changed, and APIs and virtual asset wallets should be transferred to new addresses.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NIKKE PC Launcher Compromised in Supply-Chain Attack Distributing Malware The PC launcher for 'Goddess of Victory: NIKKE' has been compromised, allowing malware to be distributed to users' PCs. The attack involved tampering with four JavaScript files on Level Infinite's CDN, which were modified on September 27, 2026. Users running the launcher from October 24 onward are at risk of having their credentials and cryptocurrency wallet data stolen. The malware allows attackers to execute commands, capture screenshots, and access sensitive information stored in browsers. Affected users are advised to stop using the launcher and change their passwords. Level Infinite has confirmed the issue and issued a client update on November 4, 2026, to address the vulnerabilities. However, some tampered files were still being served as late as November 4. The full scope of the attack and how the files were modified remain under investigation. 14 sources 70

Extracted Entities

Hacked Nikke PC launcher spreads RAT, steals accounts and crypto data

The full story

Extracted Entities

Attack Types (1)

Companies (2)

CWE Weaknesses (1)

MITRE ATT&CK (2)

Platforms (1)