Skip to content
NIKKE PC Launcher Compromised in Supply-Chain Attack Distributing Malware

NIKKE PC Launcher Compromised in Supply-Chain Attack Distributing Malware

First seen 4 Nov 2026, 03:18 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 4, 2026 at 21:19 UTC
  • •The NIKKE PC launcher was compromised, distributing malware to users' PCs.
  • •Four JavaScript files on Level Infinite's CDN were tampered with, enabling remote access.
  • •Users who launched the game from October 24 are at risk of credential theft.

The PC launcher for 'Goddess of Victory: NIKKE' has been compromised, allowing malware to be distributed to users' PCs. The attack involved tampering with four JavaScript files on Level Infinite's CDN, which were modified on September 27, 2026. Users running the launcher from October 24 onward are at risk of having their credentials and cryptocurrency wallet data stolen. The malware allows attackers to execute commands, capture screenshots, and access sensitive information stored in browsers. Affected users are advised to stop using the launcher and change their passwords. Level Infinite has confirmed the issue and issued a client update on November 4, 2026, to address the vulnerabilities. However, some tampered files were still being served as late as November 4. The full scope of the attack and how the files were modified remain under investigation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5h ago How this analysis works

Timeline

2026-09-27
JavaScript files tampered
Four files on Level Infinite's CDN were modified to include malicious code.
Invenglobal
2026-10-24
Malware installation risk begins
Users running the NIKKE PC launcher from this date may have installed the remote access tool.
Finance.Biggo
2026-11-03
Three files replaced
Level Infinite replaced three of the compromised JavaScript files on November 3.
Bleepingcomputer
2026-11-04
Client update issued
Level Infinite confirmed the issue and released a client update to address the malware.
Invenglobal

More articles in this cluster (15)

Following this threat?

Track K2F and Level Infinite in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (27)

1 / 4

Common questions

How can I check if my PC is infected?
Users should check the log file in the NIKKE installation directory for the string 'k2f_chan', which indicates malware execution.
What should I do if I'm affected?
Stop using the NIKKE launcher, change all passwords stored in browsers, and consider migrating API keys and cryptocurrency wallets.
Is the malware still active?
The malware was still being distributed from some CDN servers as late as November 4, 2026, despite the update.