The PC launcher for Goddess of Victory: Nikke, a game distributed globally by China’s Tencent, has been exploited to spread malware. Attackers are believed to have inserted commands into Tencent’s official file distribution network that directed users to malicious software.
The malware can remotely control infected PCs. Some compromised files were found to have remained available for download for more than a month without being blocked.
According to a technical analysis report published on software development platform GitHub, four JavaScript files on the content delivery network (CDN) operated by Tencent’s Level Infinite, its game publishing brand, were tampered with on Sept. 27.
A CDN is a network of servers that delivers files needed to launch or update games. A PC launcher is a program users run to start a game. During operation, the Nikke PC launcher connects to Level Infinite’s official CDN to retrieve certain files.
Attackers appear to have exploited this process. They inserted commands into files on the official CDN to retrieve malicious software from an external server. When users launched the game, the launcher read the modified files, downloaded malware from an attacker-controlled server and executed it.
The malware was identified as a remote access Trojan (RAT), which allows attackers to issue commands to infected PCs over the internet, access files and execute additional programs. According to the report, it also includes functions to capture computer screens and collect stored passwords and login credentials. The targeted information includes account credentials saved in web browsers such as Google Chrome and Microsoft Edge, cryptocurrency wallet data and cloud service authentication credentials.
The malware was also found to target credentials for artificial intelligence (AI) development tools. According to another report published by GitHub researcher WormW, the malicious code includes functions to for authentication credentials associated with development tools and cloud services, including OpenAI’s Codex, Anthropic’s Claude Code and GitHub. This means services and corporate systems unrelated to the game could also be exposed to security breaches.
The duration of the malware distribution is another concern. According to a report published by a developer known as MotherSphere on GitHub, four files on Level Infinite’s official CDN were modified on Sept. 27. The report said some CDN servers continued serving the compromised files through Nov. 3.
Goddess of Victory: Nikke was developed by South Korean game company Shift Up and is distributed globally by Tencent’s Level Infinite. Level Infinite also operates several other games, including Krafton’s PUBG Mobile.
MotherSphere, the developer who published the report, became known after posting a guide in May explaining how to run Nikke on the Linux operating system. The developer also released a separate scanning tool to help users check whether their PCs had been infected.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
