Level Infinite confirms 'Goddess of Victory: Nikke' PC launcher compromised

Level Infinite has confirmed that the PC launcher for the game 'Goddess of Victory: Nikke' was subject to a supply-chain attack involving tampered script files. The developer, SHIFT UP, stated they are currently checking the incident.

Details of the Compromise

According to a report by independent security researcher MotherSphere, four JavaScript files hosted on Level Infinite's official Content Delivery Network (CDN) were modified on September 27, 2026. These files contained malicious code designed to download additional payloads from attacker-controlled domains, specifically insightjs[.]com and insightjs[.]org.

BleepingComputer reported that the injected code used obfuscation to hide these domains and was designed to execute a malicious LuaJIT payload called insight.bundle. This payload installs a remote-access agent known as K2F. The malware allows attackers to:

• Remotely execute commands on the user's PC.
• Browse and download local files.
• Capture screenshots.
• Collect 'Nikke' account credentials and passwords stored in web browsers.
• Steal information from 28 types of cryptocurrency wallets, including recovery phrases and private keys.

Scope and Impact

The compromise specifically affected the PC client launcher. While mobile apps on smartphones or tablets were not covered by the analysis, it remains unconfirmed if mobile environments are affected. Linux and Steam Deck users running the game via compatibility software (Proton) are also exposed to the same risks.

On Windows PCs, the malware can stealthily register itself within the Chrome browser to continue operating even after the game launcher is closed. BleepingComputer noted that a malicious Windows DLL named platform_experience_helper.dll can also be installed by the malware.

Response and Remediation

Level Infinite issued a client update on November 4 at approximately 02:30 (UTC +9) to address the issue. In a statement on X, the company said, "We have identified an issue indicating that the PC Launcher's script files may have been tampered with by a third party."

While three of the four compromised files were replaced with clean versions, researchers noted that a tampered copy of the fourth file was reportedly still being served to some users as late as 7:26 AM on November 4.

To check for infection, researchers suggest users look for the string 'k2f_chan' in the file Launcher/intl_service/debug.log within the 'Nikke' installation directory. If infection is suspected, experts recommend changing passwords for major accounts from a separate, uncompromised device and transferring cryptocurrency to a newly created wallet.

---

Sources

• invenglobal.com: 'Goddess of Victory: Nikke' PC Launcher Allegedly Compromised - Inven Global
• bleepingcomputer.com: NIKKE PC game launcher hacked to spread remote access, data-stealing malware
• mk.co.kr: Suspicions have been raised that a hacking accident occurred in which malicious code was inserted in.. - MK

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.