An analysis indicates that the PC launcher for 'Goddess of Victory: Nikke', developed by SHIFT UP and published by Level Infinite, was exploited as a malware distribution vector. According to player reports and a technical report from an independent security researcher, several files automatically downloaded from official Content Delivery Network (CDN) servers when launching the client were tampered with by an unknown party. As a result, concerns have been raised that remote-control malware may have secretly executed in the environments of some users who ran the game on PC.
The suspicions began when users on the Chinese gaming community NGA noticed unusual activity. A report published on the code-sharing platform GitHub on November 3 revealed that malicious commands designed to load external malware were secretly embedded into four files on Level Infinite's official servers on September 27. All of these files execute automatically when launching the 'Nikke' PC client. The report explained that, at the latest by October 24, an attacker's remote-control tool could be installed and executed on PCs during the process of opening the launcher. The researcher added that, for safety reasons, they did not directly execute the main malware payload and analyzed only its code structure.
According to the report, while the 'Nikke' launcher remains open, the malware allows attackers to remotely issue commands to the user's PC, search for and exfiltrate files, and capture screen grabs without authorization. Target data for theft includes passwords stored in web browsers, 'Nikke' account details, and information from 28 types of cryptocurrency wallets.
Additionally, it targets SSH security keys and cloud access credentials frequently used by developers. However, the report noted that it does not harvest all general passwords stored in Windows, but is structured to extract only information associated with development tools. Notably, on Windows PCs, it can stealthily register itself within the Chrome browser to continue operating even after the game launcher is closed. Linux and Steam Deck users running the game via compatibility software (Proton) are exposed to the same risks.
Three Files Replaced, Tampered Copies Remain on Some Servers
Three of the four compromised files were replaced with clean files between 2:04 AM and 2:21 AM KST on November 4. The report highlighted that while the remaining file was cleaned on the origin server earlier on October 28, two regional CDN distribution servers were still delivering the altered file as late as 7:26 AM on November 4. How the attackers obtained authorization to modify files on official distribution servers, as well as the actual scope of user damage, remains unknown.
To quickly check whether a PC is infected, the researcher advised users to open the log file (`Launcher/intl_service/debug.log`) located in the 'Nikke' installation directory and search for the string 'k2f_chan'. Finding this string indicates traces of malware execution. However, the absence of this entry does not guarantee safety. The researcher urged players to refrain from running the PC launcher until an official fix is announced by the publisher, and to clear the temporary cache files before launching it again in the future. If infection is suspected, users should change passwords for major accounts and terminate all active sessions from a separate, uncompromised device (such as a smartphone). It is also safer to immediately transfer cryptocurrency to a newly created wallet and revoke developer security keys. On the Taiwanese gaming forum Bahamut, reports emerged that several Japanese server players also found the same traces in their logs.
PC Launcher Allegations Surface Right After 4th Anniversary Update
'Goddess of Victory: Nikke' rolled out its 4th anniversary update globally on October 29. The malware allegations were discovered exclusively in files loaded by the PC client launcher. Mobile apps on smartphones or tablets were not covered by this analysis, and it cannot be confirmed from the current report alone whether mobile environments are affected.
As of the morning of November 4, no official statements had been posted on either company's official channels.
