NIKKE PC Launcher Compromised in Supply Chain Attack Targeting Crypto Wallets

The developers of the sci-fi RPG Goddess of Victory: NIKKE have confirmed that a supply-chain attack compromised the game’s PC launcher. The breach allowed attackers to distribute malware capable of stealing user credentials, sensitive files, and cryptocurrency wallet data.

The publisher, Level Infinite, issued a client update on 4 November 2026 to address the issue after identifying that the launcher’s script files had been tampered with by a third party. The company is currently investigating the full scope of the incident.

Malicious Scripts Injected via CDN

Independent security researcher MotherSphere identified that the attack involved four JavaScript files hosted on Level Infinite’s official content delivery network (CDN). The researcher alleges that these files were modified as early as 27 September 2026 to inject malicious code that executed whenever players opened the game launcher.

The injected JavaScript used obfuscation techniques to hide connections to attacker-controlled domains, specifically insightjs[.]com and insightjs[.]org. Once activated, the code abused the launcher’s native functionality to download a LuaJIT payload known as insight.bundle.

This payload installed a remote-access agent called K2F, which provided attackers with the ability to execute remote commands, capture screenshots, browse local files, and collect NIKKE account credentials and browser-stored information.

Targeting Cryptocurrency Wallets

Technical analysis of the malware revealed a secondary, highly targeted component. The attackers could deploy a malicious Windows DLL named platform_experience_helper.dll, which could remain active even after the game launcher was closed.

This DLL was designed to intercept sensitive data from cryptocurrency browser extensions. This includes the theft of private keys and recovery phrases from widely used wallets such as MetaMask, Phantom, and Coinbase Wallet.

Detection and Mitigation

While Level Infinite has deployed fixes, researchers have noted that at least one tampered script may have remained accessible on the CDN following the initial update attempt.

Users can check for signs of compromise by searching for the following indicator of compromise (IOC) within their installation directory:

• File path: Launcher/intl_service/debug.log
• String to search: k2f_chan

Security experts recommend that any player who suspects they have been affected should run a full system scan using updated antivirus software. If a compromise is confirmed, users are advised to reinstall their operating system and change all sensitive passwords and credentials from a known clean device.