NIKKE PC launcher tampered with in supply chain attack that delivered remote access malware

TLDR

• Level Infinite says third-party tampering with NIKKE PC launcher files could have run malicious programs on players' PCs.²
• An independent researcher says altered scripts could deliver a remote-access tool able to steal credentials and wallet data.³
• Level Infinite says the current launcher is safe and the client scans for the malware from 5 November.²

The PC launcher for Goddess of Victory: NIKKE was altered in a supply chain attack, BleepingComputer reports, after the game's developers confirmed that attackers had changed its scripts.¹ Level Infinite, the game's publisher, says some files in the Windows PC launcher were tampered with by a third party, potentially allowing malicious programs to run when the launcher started.² It says players' PCs and account information may have been exposed, that it is still investigating the extent of the damage, and that it is reviewing its network security, including its CDN, to establish how the files were compromised.²

The technical detail comes from an independent researcher using the handle MotherSphere, whose analysis was published on GitHub on 3 November.³⁴ The researcher says that from 27 September four JavaScript files on Level Infinite's CDN were altered to load a script from insightjs.com, and that from 23 October at the latest this loader could download a Lua-based remote-control agent, which ran on only some launches.³ The researcher says the agent could run commands, access files, take screenshots and steal saved passwords, cookies, tokens, SSH keys and crypto wallets, and that on Windows it could install a DLL loaded by Chrome that persists after the launcher closes.³ BleepingComputer says it examined two of the altered files and confirmed the obfuscated loader and its fallback domain, and that strings in a DLL sample on VirusTotal pointed to code targeting wallet extensions including MetaMask, Phantom and Coinbase Wallet; it adds that it is unknown whether the DLL was deployed or whether any cryptocurrency was stolen.¹ The researcher also says Linux and Steam Deck users running the launcher through Proton are exposed, and cautions that the analysis rests mostly on one infected machine and community reports, with the payload analysed statically and never run.³

The accounts differ on timing and cause. Level Infinite's timeline says insightjs.com, which it describes as an open-source domain used by certain game services, was hijacked at 10:59 (UTC+9) on 27 September, that launcher scripts were partially tampered with through it at 15:41, and that distribution of malicious programs to players' PCs began at 03:52 on 30 October.² The researcher instead gives 23 October as the earliest reported run and says how the attacker gained write access to the CDN is unknown.³ Inven Global's summary of the researcher's report gives 24 October.⁵ Level Infinite says it detected anomalies around 00:00 on 4 November, replaced three files between 02:04 and 02:23, and completed a CDN cache refresh for the remaining file at 12:09.² BleepingComputer, citing the researcher, says a tampered copy of the fourth file was still being served at 22:26 GMT on 3 November, while the researcher's own write-up says all four files were clean on the servers it checked at 11:20 GMT on 4 November.¹³ CyberInsider says how many players were affected remains unclear.⁴

Level Infinite says it takes full responsibility, has prepared in-game compensation for all players, and that the currently distributed launcher is safe to use.² It advises anyone who has launched the Windows launcher since 15:41 (UTC+9) on 27 September to run a check, and says the official client will scan for and remove the malware from 8:00 (UTC+9) on 5 November.² It also recommends changing passwords for accounts used on the affected PC and revoking and replacing any API keys or access tokens.² The researcher says a "k2f_chan registered" entry in Launcher/intl_service/debug.log shows the agent ran, and that reinstalling Windows is the safest option on an infected machine.¹³ Shift Up CEO Kim Hyung-tae apologised on X on 4 November, saying the company was working with Level Infinite on a fundamental fix.⁵

Why it matters: Level Infinite says files its launcher loaded were compromised and put players' PCs and accounts at risk, and it plans an integrity verification system for external resources the launcher accesses.²