NIKKE PC launcher compromised in attack distributing data-stealing malware - Межа

The developers of Goddess of Victory: NIKKE confirmed third-party tampering with the PC launcher. A researcher and BleepingComputer reported evidence of malware that could steal account credentials and browser-stored cryptocurrency wallet data.

The game’s developers said on X that they issued a client update on November 4 at 02:30 (UTC+9) to address the problem.

This is reported by BleepingComputer .

We have identified an issue indicating that the PC Launcher’s script files may have been tampered with by a third party,

We have identified an issue indicating that the PC Launcher’s script files may have been tampered with by a third party,

Independent security researcher MotherSphere alleged in a GitHub report that four JavaScript files on publisher Level Infinite’s official content delivery network were modified on September 27, 2026. The injected code allegedly downloaded additional code from attacker-controlled servers whenever players opened the launcher. BleepingComputer examined two of the files and found an obfuscated loader that could retrieve and run code from insightjs[.]com, using insightjs[.]org as a fallback.

According to MotherSphere’s analysis, the downloaded code used the launcher’s native functions to run a malicious LuaJIT payload called insight.bundle, which installed a remote-access agent identified as K2F. The backdoor could let attackers execute commands remotely, browse and download local files, take screenshots, collect NIKKE account credentials, and steal information stored in browsers.

The malware also had a command to install a Windows DLL named platform_experience_helper.dll that could remain active after the launcher closed. BleepingComputer’s analysis of strings from a sample uploaded to VirusTotal indicated that the DLL could steal cryptocurrency wallet data from browser extensions, including MetaMask, Phantom, and Coinbase Wallet, and intercept recovery phrases and private keys. It is unknown whether attackers installed this component on infected systems or stole cryptocurrency from players.

MotherSphere said Level Infinite replaced three affected JavaScript files with clean versions on November 3, but that a tampered copy of the fourth was reportedly still being served at 22:26 GMT. The researcher shared an indicator users can check: the string k2f_chan in Launcher/intl_service/debug.log in the NIKKE installation directory. Its presence indicates that the malicious Lua agent ran, but does not show whether the DLL was also loaded.

BleepingComputer found that insightjs[.]org was serving a security warning inside the launcher, in English, Chinese, Japanese, and Korean. The warning tells players to close the launcher and not reopen the PC client until the publisher confirms the issue is resolved. It says the message is not an official announcement from the publisher; who controls the domain and when the malicious payload was replaced with the warning remain unclear. BleepingComputer said it contacted Level Infinite for on MotherSphere’s findings but had not received a response by publication.

Beware of fake emails pretending to be from the State Tax Service spreading malware. Do not open suspicious attachments to protect your computer.

A Pentagon personnel system breach exposed unencrypted personal records of 2.8 million living people and nearly 300,000 deceased, including Social Security numbers and military service details.

Security researchers say a Russian-linked hacking group UNC6353 used a new iPhone exploit called Darksword to target Ukrainian users, stealing passwords, messages, photos, browser history and possibly cryptocurrency.