"We have identified an issue indicating that the PC Launcher's script files may have been tampered with by a third party," reads the statement on X, the game's publisher said, adding that an update was pushed on November 4 at approximately 02:30 (UTC+9) to address the problem.
Level Infinite's statement and the timeline of fixes
Level Infinite — publisher of Goddess of Victory: NIKKE — confirmed on X that client fixes and an update were implemented on November 4 at about 02:30 (UTC+9) after identifying tampering of the PC Launcher's script files. The publisher said it was investigating the scope of the impact and would provide further follow-up measures in a separate notice. Level Infinite has reported more than 45 million downloads of the game since its 2022 launch; Google Play alone shows 10 million downloads.
How researchers say the launcher was abused
Independent security researcher MotherSphere, reporting on GitHub, alleges the incident involved four JavaScript files hosted on Level Infinite's official content delivery network (CDN). According to that analysis, the files were modified on September 27, 2026, to inject malicious JavaScript which downloaded additional code from attacker-controlled servers whenever players opened the game launcher.
BleepingComputer examined two of the modified JavaScript files and confirmed they contained an obfuscated loader that retrieved and executed additional code from domains insightjs[.]com and insightjs[.]org, falling back to the second domain if the first was unavailable.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleThe K2F backdoor, a LuaJIT payload, and a potentially persistent DLL
MotherSphere's analysis says the loader abused the launcher's native functionality to fetch and run a malicious LuaJIT payload called insight.bundle, which installed a remote-access agent referred to as K2F. The researcher describes K2F as capable of remotely executing commands, browsing and downloading local files, capturing screenshots, collecting NIKKE account credentials, and stealing information stored in web browsers.
The injected code also supported a command to install a Windows DLL named platform_experience_helper.dll that could remain active after the launcher was closed. BleepingComputer reviewed strings extracted from a DLL sample uploaded to VirusTotal and reported code indicating the malware can target cryptocurrency wallet data in browser extensions — explicitly naming MetaMask, Phantom, Coinbase Wallet, and others — with functionality to intercept recovery phrases and private keys.
That analysis did not establish whether attackers actually deployed the DLL on infected systems or successfully stole cryptocurrency from players; the source material states this remains unknown.
Indicators of compromise and recommended cleanup steps
- MotherSphere published indicators of compromise (IOCs) users can check; one highlighted indicator is the string k2f_chan recorded in the Launcher/intl_service/debug.log file in the NIKKE installation directory — an entry that indicates the malicious Lua agent executed but does not confirm DLL installation.
- BleepingComputer found the insightjs[.]org backup domain is now serving code that displays a multilingual security warning inside the game launcher telling players to immediately close the launcher and refrain from opening the PC client until the publisher confirms the issue has been resolved. That warning explicitly states it is not an official announcement from the game's publisher.
- The researcher claims Level Infinite replaced three of the impacted JavaScript files on November 3, but that a tampered copy of the fourth was reportedly still being served to users as of 22:26 GMT.
- Potentially affected players should run a full system scan using updated antivirus software. The reporting recommends that those who find they were compromised reinstall Windows and change passwords and other sensitive credentials from a clean device.
What this means for players, security researchers, and Level Infinite
- Players: Those who run the PC launcher should check the NIKKE Launcher/intl_service/debug.log for the k2f_chan string, follow the recommended full-system scans, and — if compromise is confirmed — perform a clean reinstall of Windows and change credentials from an uncompromised device.
- Security researchers and incident responders: The incident shows a supply-chain vector via CDN-hosted JavaScript and an obfuscated loader that fetches further payloads. Researchers will continue to analyze available samples (including the DLL uploaded to VirusTotal) and IOCs that MotherSphere published.
- Level Infinite (publisher): The company has applied client fixes and an update and said it is investigating the scope of impact; it had not responded to BleepingComputer's request for comment by the time of publication.
The public record assembled by MotherSphere and BleepingComputer establishes a plausible supply-chain compromise of the NIKKE PC launcher that delivered an extensible backdoor and a DLL capable of harvesting browser-stored cryptocurrency secrets — but it leaves a central question unresolved: whether attackers succeeded in deploying the wallet-stealing DLL or in extracting funds. Level Infinite's ongoing investigation and any further technical disclosures will be the next concrete steps for players and responders seeking to assess and remediate damage.
