Malware · 3 min read
NIKKE’s Windows PC launcher was tampered with and could install remote-access malware
Level Infinite says a hijacked domain let attackers alter NIKKE launcher scripts from late September. Malicious delivery ran from late October until fixes on November 4. Mobile play was not affected.
Players who used the Windows PC launcher for Goddess of Victory: NIKKE are being asked to check their computers after attackers tampered with launcher script files. Publisher Level Infinite and developer Shift Up published fixes and a built-in security check in early November. Malwarebytes summarized the incident on November 5, and a fan site mirror of the official apology and timeline carries the same dates.
What happened
Level Infinite’s timeline says:
- On September 27, 2026, the open-source domain insightjs.com, used by some game services, was hijacked.
- The same day, launcher script files were partly altered through that domain.
- From October 30, malicious programs began reaching players’ PCs through the compromised scripts (independent researcher MotherSphere reported signs of the remote-control agent as early as October 23).
- On November 4 the company detected the abnormal scripts, replaced them, and refreshed CDN caches so clean copies spread.
The company says the currently distributed launcher is safe after those fixes, and that the mobile version of the game was not affected.
What the malware could do
MotherSphere’s analysis, as reported by Malwarebytes, says the remote-control agent could run commands, browse and download files, take screenshots, read saved NIKKE credentials, collect browser passwords and cookies, search for developer secrets, and collect cryptocurrency wallet-extension data. How many PCs were hit, and how much was stolen, is still unclear.
What you can do
- If you only play on mobile, Level Infinite says you do not need extra steps for this incident.
- If you opened the Windows launcher at least once after September 27, 15:41 (UTC+9), run the official PC client’s security check (available from November 5). Close all browsers, including Chrome, before you launch.
- Follow Level Infinite’s manual removal guide if you prefer not to use the launcher check, including the registry and DLL steps it lists.
- Change passwords and revoke API tokens from a clean device after the check, not from a machine that may still be infected.
- If a crypto wallet or recovery phrase may have been exposed, move funds to a new wallet created on a clean device.
- Contact Level Infinite customer support if you think you lost access to external accounts or money.
How Frame helps
Frame watches for new breach disclosures against your verified emails and gives you a short checklist when something hits. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame does not remove this launcher malware; use the publisher’s check and a trusted antivirus scan.
Related coverage
- Stolen CI access published a malicious bee-js release and a trojanized Swarm Desktop build: another November supply-chain case that stole wallet material from a desktop app.
- How infostealers steal sessions: why browser passwords and cookies matter after a remote-access foothold.
Sources
- Level Infinite / NIKKE Operations (via nikke.gg mirror), Official Announcement: PC Launcher Security Incident, Manual Check, Follow-up & Apology, updated November 5, 2026
- Malwarebytes, NIKKE PC launcher compromise put players’ passwords and personal files at risk, November 5, 2026
More stories
- MalwareAttackers used AntiFox, an open-source AI hacking agent, to reach AWS production secrets · 4 min read
- MalwareMicrosoft: attackers keep a back door into hacked Linux web servers with GSocket · 4 min read
- MalwareAttackers go after Qlik Sense servers and stage exploits for ActiveMQ and Veeam · 4 min read
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.