NIKKE game launcher hijacked in supply-chain attack on players

On 4 November 2026, the publisher of Goddess of Victory: NIKKE — the sci-fi shooter RPG developed by South Korea's Shift Up and published globally by Level Infinite — confirmed that the game's Windows launcher had been tampered with in a supply-chain attack that pushed malware to players. The game has recorded more than 45 million downloads since its 2022 launch, and the compromise turned a trusted update channel into a malware-delivery pipeline for anyone who opened the launcher.

How the compromise worked

According to independent researcher MotherSphere, four JavaScript files hosted on Level Infinite's own content-delivery network were modified on 27 September 2026 so that the launcher downloaded additional payloads each time it ran. The injected code used obfuscation to conceal two attacker-controlled domains, and the loader was built to fall back to the second domain if the first was unreachable — a resilience trick that kept the delivery chain working even after partial cleanup. Because the malicious files were served from the publisher's legitimate infrastructure, players had no visible signal that anything was wrong.

The payload

The loader fetched a LuaJIT bundle that installed a remote-access agent tracked as K2F, capable of running commands, browsing and exfiltrating files, taking screenshots, and stealing both NIKKE account credentials and browser data. A follow-on command could install a Windows DLL designed to persist after the launcher closed, and researchers found code in a DLL sample that targeted cryptocurrency wallet browser extensions including MetaMask and Phantom. It was not established whether that wallet-targeting capability was actually deployed, or whether any cryptocurrency was stolen.

Response

The compromise surfaced through MotherSphere's public report, after which Level Infinite acknowledged on social media that the launcher scripts "may have been tampered with by a third party" and released a client update early on 4 November 2026. The researcher noted that three of the four affected files were restored to clean versions on 3 November, but that a tampered copy of the fourth was still being served after the update shipped, leaving the incident unresolved at the time of reporting. No threat actor was named. Level Infinite said it was investigating the scope and would issue follow-up measures, while security researchers advised affected players to run a full antivirus scan, change credentials from a clean device, and — for confirmed infections — reinstall Windows, given the remote-access agent's persistence.