Goddess of Victory: NIKKE PC launcher tampered in supply-chain attack
Original title: NIKKE PC game launcher hacked to spread remote access, data-stealing malware
Hackers modified NIKKE launcher scripts to inject remote-access malware stealing credentials and crypto wallets; update issued November 4.
Developers of Goddess of Victory: NIKKE confirmed third-party tampering of PC launcher scripts on the official CDN. Malicious JavaScript injected an obfuscated loader that downloaded a LuaJIT payload named insight.bundle, which installed the K2F remote-access agent. The backdoor steals NIKKE account credentials, browser data, and cryptocurrency wallet information including private keys from MetaMask, Phantom, and Coinbase Wallet. Level Infinite issued a client update on November 4 at 02:30 UTC+9; one researcher claims three scripts were cleaned but a fourth tampered copy remained on the CDN as of 22:26 GMT.
Unconfirmed: Level Infinite has not responded to inquiries; researcher claims remain unverified by publisher.
- Four JavaScript files modified on September 27, 2026.
- Malicious code downloads insight.bundle and installs K2F agent.
- K2F supports file browsing, screenshots, credential theft, and DLL side-loading.
- Level Infinite update deployed November 4 at 02:30 UTC+9.
- One tampered script remained on CDN after update per researcher.
Impact: remote command execution, credential theft, crypto wallet exfiltration
| Product | Affected |
|---|---|
| Level Infinite Goddess of Victory: NIKKE PC launcher | — |
- 1.scan for k2f_chan in Launcher/intl_service/debug.log
- 2.close launcher and scan with updated antivirus
- 3.reinstall Windows and change credentials from clean device
- Vendors
- Level Infinite
- Malware
- K2Finsight.bundle
- Countries
- South Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | insightjs.com | avaScript files and used obfuscation to conceal the domains insightjs[.]com and insightjs[.]org , from which the malicious code was d |
| domain | insightjs.org | used obfuscation to conceal the domains insightjs[.]com and insightjs[.]org , from which the malicious code was downloaded. BleepingC |
From the original article
3 min read at bleepingcomputer.com
The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.