Hacked Windows PC launcher for Goddess of Victory: NIKKE exposes players to malware

The Windows PC launcher for Goddess of Victory: NIKKE has been compromised, putting players’ computers and account information at risk.

Hackers turned the official Nikke PC game launcher into a malware delivery tool

According to the publisher’s investigation, the attack started on September 27, when hackers hijacked the insightjs.com domain. They then used it to tamper with four JavaScript files downloaded by the official PC launcher.

The malicious files eventually began distributing malware on October 30. The attackers reportedly used the compromised scripts to install a remote-access tool called K2F.

As detailed by BleepingComputer, the malware could execute remote commands, browse local files, capture screenshots, and collect browser-stored credentials. The research also identified functionality targeting cryptocurrency wallets, including MetaMask and Phantom. However, there is no confirmation that attackers successfully stole cryptocurrency or other sensitive information.

NIKKE players should check their PCs immediately

Level Infinite says players who launched the Windows PC launcher after September 27 at 15:41 UTC+9 should perform security checks. Starting November 5 at 8:00 UTC+9, the updated client includes an automatic inspection and removal feature.

Players should close their browsers before launching the client and follow any removal prompts. The publisher says the currently distributed launcher is safe following its fixes and additional inspections.

Those preferring a manual check can search Launcher\intl_service\debug.log for k2f_chan registered. Finding this entry indicates the malicious agent executed, although its absence does not guarantee complete safety.

The publisher also recommends changing passwords from a clean device and revoking exposed API keys or access tokens. A full antivirus scan and Microsoft Defender Offline scan are also recommended.

It should be noted that the incident didn’t affect NIKKE’s Android or iOS versions. Level Infinite has apologized and promised stronger monitoring and file-integrity checks. You can read the detailed advisory here.