Hackers slipped data-stealing malware into the PC launcher for the game NIKKE

A remote-control agent that steals saved passwords and cryptocurrency wallet data was delivered through the PC launcher for Goddess of Victory: NIKKE, according to a technical report posted to GitHub on Nov. 3 by a user named MotherSphere. The report says four official JavaScript files on the publisher’s content delivery network carried attacker code. Level Infinite, which publishes the game for developer SHIFT UP, has since acknowledged that script files may have been tampered with by a third party.

The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.

Get TLDR →

We may earn a commission if you sign up.

The reports concern the Windows PC launcher. Mobile-only players are not described as affected, though Linux and Steam Deck users who run the launcher through Proton are.

Four CDN scripts and a Lua remote-control agent

BleepingComputer reported that hackers tampered with the PC launcher scripts in a supply-chain attack and that the malware can steal credentials and cryptocurrency wallet data. The fullest public analysis is MotherSphere’s GitHub write-up, which describes three stages. The modified CDN files fetched a script from an outside domain, that script downloaded a LuaJIT payload, and the payload ran as an agent that took orders from the attacker’s server and reported back through the launcher’s embedded browser. In the write-up’s words, four official JavaScript files on Level Infinite’s CDN contained attacker code.

The capabilities are those of a full remote-access tool. While the launcher is open, the operator can run any command, read or download any file the player can reach, and screenshot every monitor. CyberInsider’s summary adds that the agent can retrieve the saved NIKKE login, browser passwords and session cookies, and search for SSH keys, API tokens and wallet extension data. Inven Global, citing the same write-up, counts data from 28 browser cryptocurrency wallets. On Windows, the agent installs a DLL that Chrome loads, so it can keep running after the launcher closes. MotherSphere analyzed the payload statically and never ran it.

The delivery route is what makes the case a supply-chain problem. Players did nothing unusual: the launcher loads its scripts from the publisher’s CDN every time it starts, so a change at that layer reached anyone who opened it. A game launcher also tends to run beside a browser with saved logins, a developer toolchain or a wallet extension on the same machine, which is why the write-up treats every credential on an affected PC as exposed rather than only the game account.

Sept. 27 edits, an Oct. 23 first run and a Nov. 4 fix

The timeline in the write-up starts on Sept. 27, when the four files were modified on the CDN. The earliest reported agent start is Oct. 23, and the agent ran only on some launches. One file, FeedList, was cleaned at its origin on Oct. 28, yet two CDN servers kept serving the altered copy. On Nov. 3, three files were replaced between 17:04 and 17:23 GMT, the attacker’s server stopped answering at 18:31, and by Nov. 4 all four files were clean on the servers checked. Inven Global’s John Popko reported on Nov. 3 that players on a Chinese forum had first pieced the claims together, and that the game’s Oct. 29 anniversary update came days before the reports.

Level Infinite’s own account arrived later. Tech-Insider, relaying a statement reported by Chosun, says the publisher apologized for the anxiety the breach caused, as did the NIKKE operations team and SHIFT UP CEO Kim Hyung-tae. Level Infinite dates the start of malicious distribution to Oct. 30 at 03:52 Korea time, which is later than the Oct. 23 first run in the independent write-up, so the two timelines do not agree. Client fixes followed around 02:30 on Nov. 4, and automatic malware detection and removal in the official PC client began at 08:00 on Nov. 5, according to that report.

Checking a PC and rotating credentials

MotherSphere’s first instruction is to look before deleting anything. Searching the launcher’s debug.log, in the Launcher/intl_service folder of the NIKKE install, for the string k2f_chan shows whether the agent ran, though its absence proves nothing. The cache holds evidence, so it should be cleared only after that check and before the launcher is opened again. Level Infinite asks anyone who ran the Windows launcher at least once after Sept. 27 at 15:41 to run a security check, update the client and, if the launcher may have run during the exposure window, disconnect the machine and scan it offline.

For machines that show signs of infection, the advice is to work from a clean device: change passwords for email, banking, Discord and browser-saved accounts, log out of every session, rotate API tokens and SSH keys, and move cryptocurrency to a new wallet with a new seed phrase. The write-up cautions that antivirus did not detect the Chrome DLL on at least one machine, so a clean scan is not conclusive. Some players also criticized the publisher for describing the incident as an inconvenience, according to CyberInsider.

Several questions remain open. How the attacker gained write access to the CDN is unknown, Level Infinite has not named the affected files or described the payload, and no source gives a count of infected players. MotherSphere also notes that some findings come from other victims’ reports that could not be independently verified.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

The day in tech, in one email: Get TLDR →

We may earn a commission if you sign up.