The team behind Goddess of Victory: NIKKE has updated its PC launcher after finding signs that a third party may have tampered with its scripts.
An independent analysis found that modified files on the publisher’s content delivery network could install malware capable of remotely controlling players’ computers and stealing credentials.
The technical report, published on November 3 by a GitHub user going by MotherSphere, draws on logs and cached files from one infected machine, analysis of the downloaded malware, and findings shared by other players. The earliest reported instance of the malware running dates to October 23, although timestamps on the altered scripts date back to September 27.
NIKKE is a sci-fi action RPG developed by South Korea’s Shift Up and published by Tencent’s Level Infinite. Its fourth-anniversary update went live worldwide on October 29 for PC, iOS, and Android. The reported attack involved the PC launcher, including when run through Proton on Linux and Steam Deck.
How the launcher delivered malware
MotherSphere found injected code in four official JavaScript files hosted on Level Infinite’s CDN. The altered scripts pulled in a second script from an external domain, which used the launcher’s own download function to fetch and run a Lua-based remote-access tool.
The tool could execute commands, download files, take screenshots, and retrieve saved NIKKE logins, browser passwords, and session cookies. It could also look for SSH keys, API tokens, and data from cryptocurrency wallet extensions. On Windows, it could install a DLL that Chrome would load, allowing malicious code to run after the launcher closed. The launcher logs can show that the tool ran, but they do not record which commands the attacker issued.
The NIKKE team said it deployed client fixes at around 02:30 UTC+9 on November 4 and is investigating the scope of the incident. MotherSphere found that three scripts had been replaced by then, but two CDN servers still served an altered copy of the fourth, FeedList.feb647c9.js, at 22:26 UTC. How the scripts were modified and how many players were affected remain unclear.
How to check for infection
In a Reddit discussion about the notice, several players took issue with the NIKKE team’s description of the incident as an “inconvenience.” Some said they were changing passwords or planning to reinstall Windows. Others asked whether the absence of known malware traces meant their PCs were safe, or whether they could reopen the launcher after the update.
Players can check whether k2f_chan is registered in Launcher/intl_service/debug.log under the game’s installation folder without opening the launcher. MotherSphere says the entry shows the remote-access tool ran. A missing entry is inconclusive, especially if the game was reinstalled or the logs were deleted.
MotherSphere advises keeping the launcher closed until Level Infinite confirms the issue and clearing its browser cache before reopening it. If there are signs the tool ran, disconnect the affected computer and use a clean device to change passwords, revoke active sessions, and rotate any exposed API tokens or SSH keys. The report recommends reinstalling the operating system on infected machines because the attacker could have installed additional malware.
Leave a Reply