Nikke

Security incidents tagged Nikke. Newest first.

1 Nikke incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Show 1 older incident

HighPartly patched
NIKKE PC launcher scripts on Level Infinite's CDN were tampered with to install remote-access, data-stealing malware
Level Infinite, publisher of Shift Up's game Goddess of Victory: NIKKE (more than 45 million downloads), confirmed on Nov 4 2026 that the PC launcher's script files may have been tampered with by a third party and shipped a client fix and update at about 02:30 (UTC+9). Researcher MotherSphere says four JavaScript files on the official CDN were modified on Sept 27 2026 to load code from attacker domains each time the launcher opened. That code abused the launcher to run a LuaJIT payload, insight.bundle, which installed a remote-access agent called K2F able to run commands, browse and download files, take screenshots, steal NIKKE credentials and browser data, and install a persistent DLL (platform_experience_helper.dll). BleepingComputer found the DLL can steal crypto wallet recovery phrases and private keys from browser extensions; it is unknown whether that component was deployed or whether funds were stolen. The researcher says a tampered copy of one file was still being served after the update.
Goddess of Victory: NIKKE PC launcher (Level Infinite / Shift Up, Windows)Since Sep 27, 2026updated Nov 4, 2026, 17:43 UTC