NIKKE PC Launcher Tampered With to Deliver Credential-Stealing Malware
Summary
NIKKE’s developer confirmed third-party tampering with PC launcher scripts. Analysis found a loader delivering a K2F backdoor with credential- and file-stealing capabilities; whether attackers deployed a wallet-stealing DLL or stole cryptocurrency is unknown.
Key points
- NIKKE’s developer confirmed third-party tampering with PC launcher scripts and said it issued a client update on November 4, 2026.
- Researcher MotherSphere alleges four JavaScript files on the publisher’s CDN were modified to load attacker-controlled code; BleepingComputer confirmed an obfuscated loader in two files.
- The loader reportedly retrieved a LuaJIT payload, insight.bundle, which installed a K2F remote-access agent.
- The backdoor could execute commands, access local files, capture screenshots, and collect NIKKE credentials and browser-stored information.
- A separate DLL contained code to steal cryptocurrency wallet data, but it is unknown whether attackers deployed it or stole cryptocurrency.
- The researcher said a tampered script may have remained available after the publisher’s update. The log entry k2f_chan can indicate execution of the Lua agent, but not whether the DLL loaded.
- The article advises potentially affected players to scan their systems and, if compromised, reinstall Windows and change credentials from a clean device.
Article Details
- Victim Organization
- Level Infinite
- Victim Domain
- Unknown
- Incident Type
- Supply-chain attack involving tampered Goddess of Victory: NIKKE PC launcher scripts that delivered remote-access and data-stealing malware.
- Incident Date
- 2026-09-27
- Disclosure Date
- 2026-11-04
- Data Types Exposed
- NIKKE account credentials
- Information stored in web browsers
- Local files
- Screenshots
- Cryptocurrency wallet recovery phrases and private keys (the malware had this capability, but successful theft was not established)
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Tampered launcher scripts downloaded and executed malicious code. The publisher implemented client fixes and an update on November 4. A researcher reported that one tampered script may still have been served afterward. The malware could execute commands, browse and download local files, capture screenshots, and collect credentials.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | insightjs[.]com | Reportedly used to download malicious code through tampered NIKKE launcher scripts; BleepingComputer confirmed the scripts retrieved and executed code from this domain. |
| DOMAIN | insightjs[.]org | Reportedly used as a backup source for malicious code through tampered NIKKE launcher scripts. The article says the domain later displayed a security warning and that its current controller was unclear. |
MITRE ATT&CK
T1005 · Data from Local SystemThe backdoor could browse and download files from infected systems.T1059.007 · JavaScriptTampered launcher scripts used JavaScript to retrieve and run additional code.T1059.011 · LuaThe downloaded malicious LuaJIT payload was executed through the launcher's native functionality.T1105 · Ingress Tool TransferThe launcher retrieved additional malicious code from external servers.T1113 · Screen CaptureThe backdoor could capture screenshots.T1555.003 · Credentials from Web BrowsersThe malware was reported to collect information stored in web browsers, including credentials.
People
Malware
Vendors
Level InfiniteIts publisher, Level Infinite, reported more than 45 million downloads since its launch in 2022, while Google Play alone reports 10 million downloads.Shift UpGoddess of Victory: NIKKE is a popular sci-fi shooter RPG developed by the South Korean firm Shift Up for Windows, iOS, and Android.