NIKKE PC Launcher Delivered Malware That Could Steal Keys

The PC launcher for Goddess of Victory: NIKKE, developed by Shift Up and Level Infinite, downloaded modified JavaScript files from Level Infinite’s official content delivery network. The files had been altered by at least Sept. 27 and were downloaded whenever the launcher started, although the malicious code did not run on every launch. How attackers accessed the CDN remains unknown.

The remote-control agent was operating by Nov. 1. Some players reported possible infections as early as Oct. 24.

While the launcher was open, the malware could execute commands, read and upload files, and capture screenshots from all connected monitors. It searched for browser-stored passwords, Windows Credential Manager data, SSH keys, cloud and artificial-intelligence service tokens, and information from 28 browser-based cryptocurrency wallets.

On Windows systems using Chrome, the malware could remain active after the NIKKE launcher closed. Linux and Steam Deck users who played through Proton may also have been exposed.

Level Infinite replaced the altered files on its CDN on Nov. 3, although some servers may have continued distributing infected copies for a period of time. The server used by the malware stopped responding later that day. A related domain was later registered by another person, who posted a warning on the site.

Players can check whether the malicious code ran by opening Launcher/intl_service/debug.log in the game’s installation folder. The entry k2f_chan indicates that the code was executed.

Until Level Infinite confirms that the issue has been resolved, users have been advised not to open the launcher and to clear its cache. People whose computers may have been infected should change their passwords from a separate, clean device, enable two-factor authentication and end active sessions. Cloud and service tokens and SSH keys should be revoked and replaced. Cryptocurrency should be transferred to a new wallet.

The incident occurred during celebrations of NIKKE’s fourth anniversary. Shift Up and Level Infinite had not publicly commented on the incident as of Nov. 4. No similar problems had been reported for the mobile versions, although their security had not been separately confirmed.