Hackers tampered with the PC launcher of the popular game Goddess of Victory: NIKKE in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data, the game's developers said.
In a notice on X, the developers said they had identified an issue indicating that the PC launcher's script files may have been tampered with by a third party. “Client fixes and an update were implemented on November 4 at approximately 02:30 (UTC+9),” the notice said. “We are currently investigating the scope of the impact caused by this issue, and we will provide further details regarding follow-up measures in a separate notice.”
Goddess of Victory: NIKKE is a sci-fi shooter RPG developed by South Korean studio Shift Up for Windows, iOS, and Android. Level Infinite reports more than 45 million downloads since its 2022 launch.
Independent security researcher MotherSphere posted a GitHub analysis alleging that four JavaScript files hosted on Level Infinite's official CDN were modified on September 27, 2026, to inject malicious code. The code was hidden within legitimate scripts and used obfuscation to conceal domains insightjs.com and insightjs.org, from which it downloaded additional payloads. BleepingComputer examined two of the modified files and confirmed they contained an obfuscated loader designed to retrieve and execute code from these domains, falling back to the second domain if the first was unavailable.
The researcher said the downloaded code abused the launcher's native functionality to load a malicious LuaJIT payload called insight.bundle, which installed a remote-access backdoor referred to as K2F. The backdoor could execute commands, browse and download local files, capture screenshots, collect NIKKE account credentials, and steal information from web browsers. It also supported a command to install a DLL named platform_experience_helper.dll that could persist after the launcher was closed.
BleepingComputer analysed a DLL sample on VirusTotal and found code indicating it could steal cryptocurrency wallet data from browser extensions including MetaMask, Phantom, and Coinbase Wallet. The DLL contained functionality to intercept sensitive wallet information, including recovery phrases and private keys, potentially allowing attackers to steal cryptocurrency. It is unknown whether the attackers deployed this component on infected systems or successfully stole cryptocurrency.
The researcher said Level Infinite replaced three of the impacted JavaScript files on November 3 with clean versions, but claimed a tampered copy of the fourth was reportedly still being served as of 22:26 GMT. The backup domain insightjs.org now serves code displaying a security warning in English, Chinese, Japanese, and Korean telling players to close the launcher immediately. Who controls the domain or when the warning replaced the malicious payload is unclear.
Potentially affected players are advised to run full system scans, and those who find they were compromised should reinstall Windows and change passwords from a clean device.
Analysis
Why This Matters
- Supply-chain attacks on game launchers give attackers direct access to millions of users, often bypassing traditional security measures.
- The malware targets cryptocurrency wallets, a growing vector for financial theft, and players of popular titles are potential victims.
- The incident highlights the difficulty of securing content delivery networks and the time window between compromise and detection.
Background
Goddess of Victory: NIKKE is a sci-fi shooter RPG developed by South Korean studio Shift Up and published by Level Infinite. The game, available on Windows, iOS, and Android, has been downloaded more than 45 million times since its 2022 launch. Supply-chain attacks on software distribution networks have become a recurring security concern across the gaming industry.
Key Perspectives
Level Infinite: Confirmed the PC launcher script files were tampered with, issued a client update on November 4, and is investigating the scope of the impact.
Security researcher MotherSphere: Detailed the attack timeline, the use of obfuscated JavaScript on the official CDN, the K2F backdoor, and the cryptocurrency-stealing DLL. The researcher noted that one tampered script was still being served after the official fix.
What to Watch
- Whether Level Infinite fully removes all compromised scripts and discloses how many players were affected.
- Whether any stolen cryptocurrency is traced to the attackers or if the theft component was deployed.
- Future security changes to the game's launcher and CDN verification processes.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedThe developers said client fixes and an update were implemented on November 4 at approximately 02:30 (UTC+9).BleepingComputer: “Accordingly, client fixes and an update were implemented on November 4 at approximately 02:30 (UTC+9).”
- SupportedThe developers said they were investigating the scope of the impact and would provide details of follow-up measures in a separate notice.BleepingComputer: “We are currently investigating the scope of the impact caused by this issue, and we will provide further details regarding follow-up measures in a separate notice.”
- SupportedThe developers confirmed that hackers tampered with the game’s PC launcher scripts in a supply-chain attack.BleepingComputer: “The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack”
- SupportedThe attack distributed malware capable of stealing credentials and cryptocurrency wallet data.BleepingComputer: “distributing malware capable of stealing credentials and cryptocurrency wallet data.”
- SupportedLevel Infinite issued a client update to address the issue on November 4 at approximately 02:30 (UTC+9).BleepingComputer: “a client update was issued on November 4 at 02:30 (UTC +9) to address the issue.”
- SupportedResearcher MotherSphere alleged that four JavaScript files on Level Infinite’s official CDN were modified to inject malicious code.BleepingComputer: “a report on GitHub by independent security researcher MotherSphere alleges the incident involved four JavaScript files hosted on Level Infinite's official content delivery network (CDN).”
- SupportedMotherSphere said the four files were modified on September 27, 2026.BleepingComputer: “According to the researcher, the files were modified on September 27, 2026, to inject malicious JavaScript”
- SupportedBleepingComputer examined two modified JavaScript files and found an obfuscated loader that retrieved and executed code from the two domains, using the second if the first was unavailable.BleepingComputer: “BleepingComputer examined two of the modified JavaScript files and confirmed that they contained an obfuscated loader designed to retrieve and execute additional code from these domains, falling back to the second domain if the first was unavailable.”
- SupportedAccording to MotherSphere’s analysis, the downloaded code installed a K2F remote-access agent that could execute commands, browse and download files, capture screenshots, and collect account and browser information.BleepingComputer: “According to MotherSphere's analysis, the downloaded code abused the launcher's native functionality to retrieve and execute a malicious LuaJIT payload called insight.bundle, which installed a remote-access agent referred to as K2F. The backdoor allowed attackers to remotely execute commands, browse and download local files, capture screenshots, collect NIKKE account credentials, and steal information stored in web browsers.”
- SupportedA DLL sample had code indicating it could steal wallet data, including recovery phrases and private keys, but it is unknown whether attackers deployed it or stole cryptocurrency.BleepingComputer: “BleepingComputer analyzed strings extracted from a DLL sample uploaded to VirusTotal and found code indicating that the malware can steal cryptocurrency wallet data from browser extensions, including MetaMask, Phantom, Coinbase Wallet, and others. The DLL contained functionality to intercept sensitive wallet information, including recovery phrases and private keys, potentially allowing attackers to steal cryptocurrency. However, it is unknown whether the attackers deployed this additional component on infected systems or successfully stole cryptocurrency from players.”
- SupportedThe researcher said Level Infinite replaced three affected JavaScript files on November 3, while a tampered copy of the fourth was reportedly still being served as of 22:26 GMT.BleepingComputer: “The researcher claims that Level Infinite replaced three of the impacted JavaScript files on November 3 with clean versions. However, they claim a tampered copy of the fourth was reportedly still being served to users as of 22:26 GMT.”
- SupportedThe insightjs.org domain was serving a security warning in four languages telling players to close the launcher immediately.BleepingComputer: “BleepingComputer also found that the insightjs[.]org backup domain is now serving code that displays a security warning inside the game launcher. The warning, displayed in English, Chinese, Japanese, and Korean, tells players to immediately close the launcher and refrain from opening the PC client until the publisher confirms the issue has been resolved.”
