Hackers Poisoned the NIKKE Game Launcher for Five Weeks, Turning a Trusted Updater Into a Password and Crypto-Wallet Stealer

For roughly five weeks, players who opened the PC launcher for Goddess of Victory: NIKKE may have been running attacker code without ever downloading anything suspicious. The game’s developers have now confirmed that script files used by the launcher were tampered with by a third party, and independent researchers say the change turned the launcher into a delivery channel for a remote-access agent that could steal passwords, browser data and cryptocurrency wallet secrets. The incident is a gaming story on the surface, but it carries a sharp lesson for every business that lets trusted software update itself.

What happened

According to BleepingComputer, the NIKKE team said in a notice on X that it had “identified an issue indicating that the PC Launcher’s script files may have been tampered with by a third party,” and that a client fix and update went out on November 4 at about 02:30 (UTC+9). The team said it is still investigating the scope of the impact. NIKKE is developed by South Korea’s Shift Up and published by Level Infinite, which has reported more than 45 million downloads since the game launched in 2022.

The technical picture comes mainly from independent researcher MotherSphere, whose incident write-up on GitHub says four JavaScript files on Level Infinite’s content delivery network were modified on September 27 to load code from an attacker-controlled domain. Because the launcher displays its pages in an embedded Chromium browser, it simply ran that script. From October 23 at the latest, and only on some launches, the script used the launcher’s own JavaScript bridge to download a payload called insight.bundle, a LuaJIT program the researcher describes as a remote-access agent known as K2F.

BleepingComputer said it examined two of the modified files and confirmed they contained an obfuscated loader that fetched more code from insightjs[.]com, falling back to insightjs[.]org if the first domain was unavailable.

What the malware could do

The agent’s command list, published by MotherSphere, covers running commands, browsing and downloading files, taking screenshots, collecting credentials and scanning browsers and wallet files. BleepingComputer reported that an optional component, a Windows DLL named platform_experience_helper.dll, could stay active after the launcher was closed, and that strings in a sample pointed to theft of wallet data from browser extensions such as MetaMask, Phantom and Coinbase Wallet, including recovery phrases and private keys.

A second analysis kit on GitHub, whykusanagi/nikke_malware, describes how that persistence works: the DLL is registered under the current user as a fake Windows Parental Controls component, which Chromium-based apps load at startup. That means it could run inside Chrome, Edge, Steam, Spotify, Discord and other Electron apps, with no administrator rights needed, and read passwords, cookies and data from 28 crypto wallets.

Inven Global reported that Shift Up CEO Kim Hyung-tae has apologized for the incident, and that the reported targets also included developer SSH keys and cloud access credentials. Players on Linux and Steam Deck running the Windows client through the Proton compatibility layer were analyzed as exposed to the same risk.

Some important questions remain open. BleepingComputer noted it is unknown whether the attackers actually deployed the wallet-stealing DLL on infected machines or stole any cryptocurrency. MotherSphere says it is still not known how the attacker got write access to the CDN, and claims a tampered copy of one file was still being served late on November 3, after the other three had been replaced.

Why it matters for business

The trusted channel was the attack. Nobody had to click a phishing link. The launcher fetched scripts from its publisher’s own CDN, exactly as designed, and the attacker only needed to change files at that source. This is the same pattern behind many recent software supply chain attacks: compromise the place software updates come from, and every customer installs the payload for you. For companies, any app that pulls live web content or scripts at runtime belongs on the list of things that can push code into your environment.

Home PCs are work PCs now. A game launcher sounds like a consumer problem, but the reported targets included SSH keys and cloud credentials, and the DLL could ride along inside browsers, Discord and Steam. Many developers and remote employees game on the same machine they use to reach company systems. One infected personal device can hand an attacker the keys to source code repositories or cloud consoles.

Stolen cookies beat passwords and MFA. MotherSphere’s guidance warns that a stolen session cookie works without the password, which is why it tells victims to log out of all sessions, not just change passwords. Infostealers that grab browser cookies let attackers skip multi-factor prompts entirely, so session revocation needs to be part of any response.

Dwell time is the real cost. The files were changed on September 27 and the fix landed November 4. Researchers, not the publisher, surfaced the technical details. Businesses that ship software, especially anything that loads remote content, should monitor their own CDN and distribution files for unexpected changes, protect publishing credentials with strong authentication, and sign and verify what their clients run.

What affected users and IT teams should do

MotherSphere lists one indicator as the string k2f_chan registered in Launcher/intl_service/debug.log inside the NIKKE install folder, which signals the Lua agent ran. The researcher’s recovery guide advises changing passwords from a clean device, logging out of all sessions, revoking API tokens and SSH keys, moving crypto to a wallet with a new seed phrase, and blocking the attacker domains. BleepingComputer adds that anyone who finds signs of compromise should reinstall Windows. IT teams should ask whether staff use the NIKKE PC client on machines that touch company accounts, and rotate those credentials if so.

The bottom line

The NIKKE launcher compromise shows how quietly a supply chain attack can run when it lives inside software people already trust. The fix is out, but the stolen data, if any was taken, stays useful to attackers until credentials and sessions are rotated. For business leaders, the takeaway is to treat every self-updating app, including the ones employees install for fun, as part of the attack surface, and to make session and key rotation a standard step whenever an infostealer is involved.

Edited by Coron @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous