NIKKE PC Launcher Compromise Put Players’ Passwords and Personal Files at Risk
Summary
Malicious JavaScript files on Level Infinite’s CDN could let a remote-control agent run when players opened the NIKKE Windows launcher. The number of affected PCs and extent of any data theft remain unclear.
Key points
- Researcher MotherSphere identified malicious code in four JavaScript files hosted on Level Infinite’s official CDN.
- The reported remote-control agent could run commands, browse and download files, take screenshots, and collect saved credentials, browser data, developer secrets, and cryptocurrency wallet-extension data.
- Level Infinite said distribution began Oct. 30; MotherSphere reported evidence of the agent running as early as Oct. 23.
- Level Infinite replaced abnormal scripts and refreshed the CDN cache on Nov. 4; MotherSphere later reported all four files clean on the four CDN servers it checked.
- The number of compromised PCs and the extent of any data theft are unknown. Level Infinite says mobile-only players are unaffected.
- Players who opened the Windows launcher during the reported period are advised to check their PCs, follow NIKKE’s removal instructions, and secure accounts from a clean device.
Article Details
- Victim Organization
- Level Infinite
- Incident Type
- Supply-chain compromise involving malicious code in four JavaScript files hosted on Level Infinite’s official CDN, which could run when players opened the Windows launcher. Level Infinite says malicious-program distribution began on October 30; MotherSphere reports evidence of the remote-control agent running as early as October 23.
- Incident Date
- 2026-10-23
- Data Types Exposed
- NIKKE login credentials (the agent could retrieve them)
- Browser passwords and cookies (the agent could collect them)
- Developer credentials, API tokens, and other secrets (the agent could search for them)
- Cryptocurrency wallet-extension data (the agent could collect it)
- Files on affected PCs (the agent could browse folders and download files)
- Affected Records
- Unknown; the number of compromised PCs remains unclear.
- Affected Data Size
- Unknown; the full extent of any data theft remains unclear.
- Operational Impact
- Malicious code in four JavaScript files hosted on Level Infinite’s official CDN could run when the Windows launcher was opened. Level Infinite replaced three abnormal script files early on November 4 and refreshed the CDN cache for the remaining file later that day. MotherSphere reported that all four files were clean on the four CDN servers it checked.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed