NIKKE launcher breach: PC launcher scripts tampered with to spread credential- and crypto-stealing malware, fix issued November 4
The developers of Goddess of Victory: NIKKE confirmed on November 4, 2026 that a third party tampered with the game's PC launcher scripts, and issued a client fix at about 02:30 (UTC+9) that day; independent analysis reported by BleepingComputer says the tampered scripts delivered a remote-access agent able to steal game credentials, browser data and files, with code that could target cryptocurrency wallet data — the scope of impact is still under investigation.
What happened
What happened: The developers of Goddess of Victory: NIKKE — a sci-fi shooter RPG developed by South Korea’s Shift Up and published by Level Infinite, with more than 45 million downloads reported since its 2022 launch — said in a notice published on X that the script files used by the game’s PC launcher “may have been tampered with by a third party,” and that client fixes and an update were implemented on November 4, 2026 at approximately 02:30 (UTC+9). The company says it is still investigating the scope of the impact and will give follow-up measures in a separate notice. BleepingComputer reported the disclosure on November 4.
Independent researcher MotherSphere reported that four JavaScript files hosted on Level Infinite’s official content delivery network were modified on September 27, 2026 to load code from attacker-controlled servers whenever players opened the launcher; BleepingComputer examined two of the modified files itself and confirmed they contained an obfuscated loader designed to retrieve and execute additional code. According to that analysis, the downloaded code installed a remote-access agent referred to as K2F, and a further component — a Windows DLL named platform_experience_helper.dll — could stay active after the launcher was closed; strings BleepingComputer found in a sample of that DLL indicated code able to steal cryptocurrency wallet data from browser extensions, including MetaMask, Phantom and Coinbase Wallet, including recovery phrases and private keys. It is not known whether that component was deployed on infected systems or whether cryptocurrency was actually stolen.
Who is affected
Who is affected: People who played Goddess of Victory: NIKKE on PC through the official launcher — the tampering was in the PC launcher’s scripts, not the iOS or Android apps. The remote-access agent described in the analysis could remotely execute commands, browse and download local files, capture screenshots, collect NIKKE account credentials, and steal information stored in web browsers. The publisher has given no count of affected players, and its investigation into the scope is continuing.
How serious
How serious: The concrete risks are account takeover, credential theft and cryptocurrency theft. A remote-access agent on a player’s PC can hand an attacker the passwords saved in the browser and the game account itself, and wallet recovery phrases or private keys — if that component ran — can be used to empty a wallet with no way to reverse the transfer. Because the malicious code arrived through the game’s own official launcher, players did nothing visibly wrong; the exposure window reported by the researcher runs from the September 27 modification until the November 4 fix.
What to do now
What to do now: Update the NIKKE PC launcher to the fixed client the publisher issued on November 4 before playing again, and run a full system scan with updated antivirus software. You can check one reported indicator: the string “k2f_chan registered” in the Launcher/intl_service/debug.log file inside the NIKKE installation folder indicates the malicious agent executed (it does not by itself confirm the wallet-stealing DLL loaded). If you find signs of compromise, reinstall Windows and change your passwords and other sensitive credentials from a clean device, and review your cryptocurrency wallets for transfers you did not make — move remaining funds to a new wallet created on a clean device if recovery phrases may have been exposed. Treat any in-launcher or emailed warning that does not come from the publisher’s official channels with caution: BleepingComputer found a warning now served from one of the attacker domains, and it is unclear who controls it.
Sources: BleepingComputer, “NIKKE PC game launcher hacked to spread remote access, data-stealing malware,” November 4, 2026 (quoting the NIKKE team’s notice on X, November 4, 2026, and independent researcher MotherSphere’s analysis)