NIKKE PC game launcher hacked to spread remote access, data-stealing malware

What it is

Hackers tampered with four JavaScript files on Level Infinite's official CDN that the Windows launcher of Goddess of Victory: NIKKE loads. The publisher confirmed on X that the launcher's script files "may have been tampered with by a third party" and shipped a client update on November 4, 2026 at about 02:30 (UTC+9). It is still investigating the scope and has not answered BleepingComputer. Most technical detail comes from independent researcher MotherSphere's GitHub report, not from the publisher.

How it works

• According to the researcher, the files were modified on September 27, 2026. Each time a player opened the launcher, the injected code fetched more code from insightjs[.]com, falling back to insightjs[.]org.
• BleepingComputer examined two of the modified files and confirmed the obfuscated loader and the domain fallback.
• The downloaded code abused native launcher functionality to run a LuaJIT payload, insight.bundle, which installed the K2F remote-access agent.
• K2F can run commands, browse and download local files, take screenshots, collect NIKKE account credentials and steal browser-stored data.
• A further command installs platform_experience_helper.dll, which can stay active after the launcher closes. BleepingComputer's string analysis of a VirusTotal sample found code to steal wallet data from browser extensions (MetaMask, Phantom, Coinbase Wallet and others), including recovery phrases and private keys.

Preconditions / Affected

Players using the Windows PC launcher who opened it while the tampered scripts were served. The mobile clients are not mentioned as affected.

What to do

Check whether the Lua agent ran: look for the string k2f_chan in Launcher/intl_service/debug.log inside the NIKKE installation directory. A hit means the agent executed. It does not show whether the DLL was loaded, so also look for platform_experience_helper.dll.

Block insightjs[.]com and insightjs[.]org.

The page's remediation advice:

1. Run a full scan with updated antivirus software.
2. If compromised, reinstall Windows.
3. Change passwords and other sensitive credentials from a clean device.

The page does not say this, but anyone with wallet extensions in the affected browser profile has reason to treat those wallets as exposed.

Caveats

• The researcher says three of the four files were replaced with clean versions on November 3. A tampered copy of the fourth was reportedly still served as of 22:26 GMT, so the November 4 client update may not have closed the exposure.
• It is unknown whether the attackers deployed the wallet-stealing DLL on any machine or took any cryptocurrency.
• insightjs[.]org now serves a warning in English, Chinese, Japanese and Korean telling players to close the launcher and not open the PC client until the publisher confirms a fix. The message says it is not an official announcement. It is unclear who controls the domain or when the payload was replaced.
• The page does not explain how the CDN was compromised or give the number of affected players.