November 4, 2026: The publisher of Goddess of Victory: NIKKE confirmed that "the PC Launcher's script files may have been tampered with by a third party." A researcher found that the tampered launcher could install a remote-access agent able to steal game credentials, browser data and files. The files appear to have been altered on September 27, and a fixed client shipped on November 4. Only the PC version is affected. The catalog entry records the details.
What happened
NIKKE is developed by Shift Up and published globally by Level Infinite, Tencent's publishing brand. Independent researcher MotherSphere found that four JavaScript files used by the PC launcher had been modified on September 27, 2026. Three were replaced with clean versions on November 3, but a tampered copy of the fourth was still being served after that. The publisher released a client fix and update on November 4 at about 02:30 (UTC+9), followed by a notice with instructions for checking PCs.
How the malware worked
- Obfuscated JavaScript in the launcher fetched code from
insightjs[.]com, withinsightjs[.]orgas a fallback. - That code delivered a LuaJIT payload,
insight.bundle, which installed a remote-access agent called K2F. - K2F could run commands, browse and download files, take screenshots, collect NIKKE login details and steal browser data.
- An optional command installed
platform_experience_helper.dll, which could keep running after the launcher closed and targeted crypto-wallet extensions such as MetaMask, Phantom and Coinbase Wallet.
Verified and unverified
- Confirmed by the publisher: the launcher's script files were tampered with by a third party, and a fix was released.
- From the researcher, not confirmed by the publisher: the September 27 start date, the malware chain and its capabilities.
- Unknown: how many players ran the tampered launcher, whether the wallet-stealing DLL was ever deployed, whether any crypto was stolen, and how the attacker got into the launcher's file delivery. Level Infinite has not answered press questions.
Who is at risk
Anyone who opened the NIKKE PC launcher between late September and November 4, 2026. The game has more than 45 million downloads, but most players are on mobile, which is not affected. A PC that ran the agent should be treated as fully compromised, because K2F gave the attacker remote control, not just a copy of the game login. Players who keep browser wallets on the same PC face the highest risk.
Attacks through trusted update channels have come up repeatedly this year. Recent examples include the cPGuard update hijack and the AOMEI Backupper installer compromise.
What to do
- Update the NIKKE PC client to the version released on November 4 or later.
- Check
Launcher/intl_service/debug.login the game folder for the stringk2f_chan registered. If it is there, the agent ran on your PC. Its absence does not prove the DLL never loaded. - Run a full scan with up-to-date antivirus software.
- If the agent ran, back up your personal files, then reinstall Windows. Removing individual files is not enough for a remote-access infection.
- From a clean device, change the passwords saved in your browsers, starting with email, banking and your NIKKE account, and turn on multi-factor authentication.
- If you had a crypto-wallet extension on that PC, move your funds to a new wallet with a new seed phrase created on a clean device.
- Block
insightjs.comandinsightjs.orgif you manage a network.
Sources
Sourcing note: the publisher's statement confirms the tampering. The malware details come from researcher MotherSphere as reported by BleepingComputer.