The developers of **Goddess of Victory: NIKKE** have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data. According to a notice published on X, a client update was issued on November 4 at 02:30 (UTC +9) to address the issue. The developers stated, "We have identified an issue indicating that the PC Launcher's script files may have been tampered with by a third party." **Goddess of Victory: NIKKE** is a popular sci-fi shooter RPG developed by the South Korean firm **Shift Up** for Windows, iOS, and Android. Its publisher, **Level Infinite**, reported more than 45 million downloads since its launch in 2022. ## Malicious Launcher Scripts Delivered Backdoor Although **Level Infinite** has not disclosed extensive details, a [report on GitHub](https://gist.github.com/MotherSphere/d6c049a09ba8ac3085c51ee9df24a4e5) by independent security researcher **MotherSphere** alleges the incident involved four JavaScript files hosted on **Level Infinite**'s official content delivery network (CDN). According to **MotherSphere**, the files were modified on September 27, 2026, to inject malicious JavaScript that downloaded additional code from attacker-controlled servers whenever players opened the game launcher. The injected code was hidden within legitimate JavaScript files and used obfuscation to conceal the domains `insightjs[.]com` and `insightjs[.]org`, from which the malicious code was downloaded. BleepingComputer examined two of the modified JavaScript files and confirmed they contained an obfuscated loader designed to retrieve and execute additional code from these domains, falling back to the second domain if the first was unavailable. ### The K2F Backdoor and Data Theft **MotherSphere**'s analysis indicates the downloaded code abused the launcher's native functionality to retrieve and execute a malicious LuaJIT payload called `insight.bundle`, which installed a remote-access agent referred to as **K2F**. The backdoor allowed attackers to remotely execute commands, browse and download local files, capture screenshots, collect NIKKE account credentials, and steal information stored in web browsers. The malware also supported an additional command to install a malicious Windows DLL named `platform_experience_helper.dll` that could remain active after the game launcher was closed. BleepingComputer analyzed strings extracted from a DLL sample uploaded to [VirusTotal](https://www.virustotal.com/gui/file/4bfaf98a6b863fa79554d9eeeb18870c3f92d552d62f4bd35a72d19ea68526af/) and found code indicating the malware can steal cryptocurrency wallet data from browser extensions, including **MetaMask**, **Phantom**, **Coinbase Wallet**, and others. The DLL contained functionality to intercept sensitive wallet information, including recovery phrases and private keys, potentially allowing attackers to steal cryptocurrency. However, it is unknown whether the attackers deployed this additional component on infected systems or successfully stole cryptocurrency from players. ## Ongoing Concerns and User Guidance **MotherSphere** claims that **Level Infinite** replaced three of the impacted JavaScript files on November 3 with clean versions. However, a tampered copy of the fourth was reportedly still being served to users as of 22:26 GMT, suggesting at least one compromised script may have remained accessible after the company deployed its client update. **MotherSphere** also shared indicators of compromise (IOCs) that users can check to determine whether the malicious Lua agent executed on their computers. One indicator is the string `k2f_chan registered` in the `Launcher/intl_service/debug.log` file within the NIKKE installation directory. This entry indicates the malicious Lua agent executed, but it does not confirm whether the DLL was loaded as well. BleepingComputer also found that the `insightjs[.]org` backup domain is now serving code that displays a security warning inside the game launcher.  The warning, displayed in English, Chinese, Japanese, and Korean, advises players to immediately close the launcher and refrain from opening the PC client until the publisher confirms the issue has been resolved. The message confirms this is not an official announcement from the game's publisher, so it is unclear who currently controls the domain or when the malicious payload was replaced with the warning. BleepingComputer has contacted **Level Infinite** for comment on **MotherSphere**'s findings but has not received a response by publication. Potentially affected players should run a full system scan using updated antivirus software. Those who find they were compromised should reinstall Windows and change passwords and other sensitive credentials from a clean device.