Overview
The developers of Goddess of Victory: NIKKE confirmed that attackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware that steals credentials and cryptocurrency wallet data. The mobile version does not use the PC launcher and is not affected.
Attack Details
- Malicious JavaScript was injected into files served from publisher Level Infinite's official CDN. Researcher MotherSphere reported four launcher JavaScript files modified on September 27, 2026.
- Opening the launcher could download and run a remote-access agent called K2F, capable of executing commands, capturing screenshots, and stealing browser-stored credentials.
- A further command could install a malicious DLL,
platform_experience_helper.dll, that persists after the launcher closes and targets wallets such as MetaMask, Phantom and Coinbase Wallet. One analysis says it covers 28 wallet types. - Linux and Steam Deck players running the launcher via Proton are reportedly exposed as well.
- The exposure window is unclear: sources cite September 27, October 24 and November 1 as start dates. A client fix was released on November 4, and one tampered script reportedly remained live afterward. The publisher has since issued an update with instructions for checking for compromise.
Am I Affected?
Open Launcher/intl_service/debug.log in the NIKKE install folder and search for k2f_chan. A hit means the agent ran.
Recommendations
- Avoid the PC launcher until the publisher confirms a full fix, and clear its cache before reuse.
- If compromised, change passwords stored in browsers, rotate API keys, and move crypto assets to new wallets created on a clean device.
- Check for the
platform_experience_helper.dllfile and run an endpoint scan. - Organizations: block unapproved game launchers on managed endpoints.
Sources
- BleepingComputer
- SC World, Inven Global