The PC launcher for "Goddess of Victory: Nikke," one of South Korea's biggest game exports, became a gateway for malicious software that could put players' saved passwords, cryptocurrency wallets and work credentials within an attacker's reach.
Four script files downloaded by the launcher from publisher Level Infinite's content delivery network (CDN) were altered on Sept. 27. The compromised files remained in circulation for more than five weeks, although when they began delivering malware is disputed.
Level Infinite's timeline puts the start of malware distribution at Oct. 30. Independent researcher MotherSphere's analysis cites evidence of the remote-access agent running as early as Oct. 23. The distinction matters: the period during which files were compromised does not establish that every player was exposed to active malware throughout that time.
The incident affected the PC launcher, not the mobile version, according to the publisher.
Nikke, in which players command android heroines against a machine invasion, has drawn more than 45 million downloads since its 2022 launch, combining accessible controls, a sprawling story and anime-style characters.
The altered files could install a remote-access tool called K2F capable of collecting browser passwords, session cookies, developer credentials and data from 28 browser cryptocurrency wallet extensions, according to MotherSphere's analysis published on GitHub.
"Once again, we offer our deepest apologies for the distress we have caused," Kim Hyung-tae, chief executive of developer Shift Up, said in a post on X.
Neither Shift Up nor Level Infinite, a Tencent Holdings unit, has disclosed how many PCs were infected or whether cryptocurrency was stolen.
"Whether you play a game, shop online or send an email, once your PC is taken over, you have to assume everything inside it is taken over," said Park Choon-sik, a professor of information security at Seoul Women's University.
Park questioned whether accountability for unsafe software had kept pace with its potential to cause harm.
"Have you ever seen anyone get a recall for a software, like PC game?" he said.
Players sounded the public alarm before the publisher did.
Even the launcher carried a warning before the publisher's announcement.
A third party registered the malware's fallback domain, insightjs.org, and used it to display a security advisory. The warning appeared inside the launcher, urging players to close it. The identity of whoever posted it remains unknown.
"Game companies tend to budget only for making a game and the problems that may come up until then," said Kim Jung-tae, a professor at the School of Game at Dongyang University.
"They fail to think through the live service that follows."
Kim said companies needed to prepare more thoroughly for the security demands of operating games long after release.
"The company has to fulfill its duty, but users need to take special care too," he said.
In this case, however, the identified route of infection was the game's official launcher downloading compromised files from its publisher's distribution network.
Level Infinite said it introduced a malware detection and removal feature in the PC client at 8 a.m. Thursday. It also advised affected players to change account passwords and replace exposed access keys or tokens, preferably using an unaffected device.
Attacks that hijack a game's official distribution path are "a far more serious supply-chain security problem" than ordinary account hacking, said Hwang Suk-jin, a professor at Dongguk University's graduate school of international affairs and information security.
In Nikke, commanders hold the line against invading machines. This time, the invader came through the launcher.
AJP Takeaways
- Four JavaScript files that the PC launcher of Shift Up’s “Goddess of Victory: Nikke” loads from Level Infinite’s content delivery network were altered by a third party on Sept. 27, 2026, Level Infinite said on Nov. 4, 2026.
- The remote-access malware could steal browser passwords, session cookies, developer keys and data from 28 browser cryptocurrency wallets.
- The number of infected PCs and any financial losses have not been disclosed.
- Level Infinite replaced the altered files on Nov. 4, 2026, and added a malware scanner to the Nikke PC client on Nov. 5, 2026.
Copyright ⓒ Aju Press All rights reserved.