Behold, dear readers, the less glorious side of technology: the PC launcher for Goddess of Victory: NIKKE, the official program players open to play, spent days delivering malware instead of just launching the game. Level Infinite, which runs the game on PC, published an apology on November 5 along with a timeline of the attack and a check-up guide. The mobile version was not affected.
What happened
According to Level Infinite’s own investigation, a domain used by some of the game’s services was hijacked by a third party on September 27. That same day, four script files the launcher downloads from the official CDN were tampered with. Malware distribution through those scripts began on October 30 and was only detected on November 4, when three files were replaced with clean versions and the cache of the fourth was refreshed. An independent researcher, MotherSphere, had published the alert on GitHub on the 3rd.
In practice, this means anyone who opened the launcher in that window may have unknowingly downloaded a remote-access agent called K2F. According to BleepingComputer’s analysis, it could run commands, browse and download files, capture screenshots and collect game credentials and data stored in browsers. An optional component, a DLL that stays active after the launcher is closed, contained code to steal cryptocurrency wallet data from extensions such as MetaMask, Phantom and Coinbase Wallet. It is unknown whether that component was ever deployed against players.
Who needs to check
Level Infinite asks everyone who opened the Windows launcher at least once after September 27 at 15:41 KST to run a check. Since November 5 at 08:00 KST, the official PC client includes a feature that detects and removes the malware on its own: close every browser, open the client and accept the removal when the prompt appears.
How to check on your own
For those who would rather not open the launcher, the official guide describes a manual check:
- Disconnect from the internet and close the game, the launcher and Chrome; make sure no NIKKE icon is left in the Windows system tray.
- In the launcher’s install folder, open
Launcher\intl_service\debug.login Notepad. - Search (Ctrl + F) for the text
k2f_chan registered. If it is there, the malware may have run on your PC: follow the removal guide in the official notice, which includes deleting a specific registry entry. - If it is not there, the risk is not ruled out: update your antivirus and run a full scan; the company also recommends a Microsoft Defender Offline scan.
Either way, the advice is to change passwords from a clean device, revoke any API keys and tokens that were stored on the PC and, in case of account or financial losses, contact official support, which says it is reviewing those reports. Level Infinite promises in-game compensation, stronger monitoring, integrity checks for the launcher’s external files and least-privilege rules for the program’s features.
The apologies
The game’s operations team wrote that “it should never happen that an official program executed to enjoy the game could instead threaten user safety” and that it feels “a deep sense of responsibility” for the failure. Kim Hyung-tae, CEO of Shift Up, the studio that develops NIKKE, also apologized on X: “In cooperation with Level Infinite, we are mobilizing all our resources to find a fundamental solution to this matter.”
It is a week of contrasts for Shift Up: on the same Thursday, Stellar Blade Complete Edition arrived on Switch 2. And the case is a reminder that supply-chain attacks are not reserved for exchanges, as in October’s possible Binance hack: sometimes the entry point is a game launcher. The full official notice is on the NIKKE website.
Sources: Level Infinite, Shift Up, BleepingComputer, Inven Global and Chosun.
Lady Combo
