NIKKE PC launcher scripts on Level Infinite's CDN were tampered with to install remote-access, data-stealing malware
Goddess of Victory: NIKKE PC launcher (Level Infinite / Shift Up, Windows)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Level Infinite, publisher of Shift Up's game Goddess of Victory: NIKKE (more than 45 million downloads), confirmed on Nov 4 2026 that the PC launcher's script files may have been tampered with by a third party and shipped a client fix and update at about 02:30 (UTC+9). Researcher MotherSphere says four JavaScript files on the official CDN were modified on Sept 27 2026 to load code from attacker domains each time the launcher opened. That code abused the launcher to run a LuaJIT payload, insight.bundle, which installed a remote-access agent called K2F able to run commands, browse and download files, take screenshots, steal NIKKE credentials and browser data, and install a persistent DLL (platform_experience_helper.dll). BleepingComputer found the DLL can steal crypto wallet recovery phrases and private keys from browser extensions; it is unknown whether that component was deployed or whether funds were stolen. The researcher says a tampered copy of one file was still being served after the update.
Why this severity: Official game launcher with a large install base silently ran a remote-access backdoor for about five weeks; the scope of impact is still under investigation
- Started
- Sep 27, 2026
Affected
Not published yet
Fixed in
No fixed release yet
Timeline5
Level Infinite says the PC Launcher's script files may have been tampered with by a third party, and that client fixes and an update went out at about 02:30 (UTC+9). It is still investigating the scope of the impact.
BleepingComputer confirms two of the modified files contain an obfuscated loader, and finds a DLL sample with code to steal crypto wallet data (recovery phrases and private keys) from browser extensions such as MetaMask, Phantom and Coinbase Wallet.
Shift Up founder Kim Hyung Tae says the studio is working with Level Infinite on a fundamental fix for the PC launcher issue and is preparing follow-up measures for players.
Level Infinite replaces three of the four tampered launcher files with clean versions, per MotherSphere, who says a tampered copy of the fourth was still being served as of 22:26 GMT.
Four JavaScript files for the NIKKE PC launcher on Level Infinite's official CDN are modified to inject an obfuscated loader that fetches more code from attacker-controlled insightjs[.]com and insightjs[.]org whenever players open the launcher, according to researcher MotherSphere.
News & write-ups2
Notes & caveats
Level Infinite has not disclosed technical details or how many players were affected. Mobile versions have not been reported as affected. The attacker's backup domain insightjs[.]org now shows an unofficial warning telling players to close the launcher; it is unclear who controls it.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
