Level Infinite, the publisher of the game Goddess of Victory: NIKKE, has confirmed that the game’s PC launcher was compromised by a third party, putting players at risk of malware that can take remote control of their computers. The publisher apologized on November 4, a day after the problem was reported publicly.
According to the publisher, an open-source domain used by some of its game services was hijacked on September 27, and attackers tampered with the launcher’s script files the same day. Malicious programs began reaching players’ PCs through the altered scripts on October 30. The company detected anomalies on November 4, replaced the bad files and refreshed its CDN cache, and the corrected file was still rolling out across nodes, as reported by Automaton.
Analysis published by security vendor Aviatrix, which draws on earlier reporting and an independent researcher’s findings, says the altered scripts fetched obfuscated code from attacker-run domains, insightjs[.]com and insightjs[.]org. It describes a remote-access backdoor called K2F that can run commands, browse and exfiltrate files, capture screenshots and take game credentials and browser data, plus a DLL aimed at cryptocurrency wallet extensions such as MetaMask, Phantom and Coinbase Wallet. Aviatrix sells network security products, and neither source reports confirmed theft totals.
Players on affected PCs are told to change all passwords, API keys and access tokens. The launcher now includes a feature that detects and removes the malicious programs, and players should close their browsers before running it. A manual guide covers checking security logs and deleting abnormal files. All players received in-game compensation items, and anyone who suffered financial losses is directed to customer support. The publisher says it will review its launcher security processes, add integrity checks for external resources and reduce launcher permissions.