Players of Goddess of Victory: NIKKE are being urged to check their PCs after attackers tampered with files used by the game’s Windows launcher. Opening the launcher could allow malicious software to run, potentially exposing much more than a player’s game account.
The incident occurred as part of a supply-chain attack, where services or software used by the company in question is compromised. In practice, this meant that instead of persuading players to download a fake game or install a suspicious add-on, the attackers compromised resources used by the legitimate launcher. Players could therefore encounter the threat simply by opening software they already trusted.
Game publisher Level Infinite has released fixes and added a malware-checking feature to the official PC client. However, fixing the delivery mechanism does not undo an infection, nor does it recover passwords and other information that may have been stolen.
Breaches happen every day. Don’t be the last to know.
Independent researcher MotherSphere identified malicious code in four JavaScript files hosted on Level Infinite’s official content delivery network (CDN).
Players should be aware of a discrepancy in the published timelines. Level Infinite says malicious-program distribution began on October 30. while MotherSphere reports evidence of the remote-control agent running as early as October 23.
According to the researcher’s analysis, the distributed remote-control agent supported commands to:
- Run programs and system commands.
- Browse folders and download files.
- Take screenshots.
- Retrieve saved NIKKE login credentials.
- Collect browser passwords and cookies.
- Search for developer credentials, API tokens, and other secrets.
- Collect cryptocurrency wallet-extension data.
The number of compromised PCs and the full extent of any data theft remain unclear.
How to stay safe
Mobile-only players are not affected, according to Level Infinite, so they do not need to take any additional security measures.
Level Infinite says it replaced three abnormal script files early on November 4, then refreshed the CDN’s cache for the remaining file later that day. MotherSphere subsequently reported that all four files were clean on the four CDN servers checked.
If you opened the Windows launcher during the period identified above, take the following steps.
- Close the launcher and check your PC. MotherSphere’s report includes user-reported Malwarebytes detections for traces associated with the attack.
- Follow the removal instructions published by NIKKE carefully.
- Secure your accounts from a clean device. Do not change passwords on a computer that may still be compromised.
- If a cryptocurrency wallet or its recovery phrase may have been exposed, use a clean device to move funds to a newly created wallet with a new recovery phrase.
- Level Infinite asks players who believe they were affected, including those experiencing problems with external accounts or financial losses, to contact its customer support team, so keep relevant records without handing over personal information.
Please note that the NIKKE wiki’s unofficial cleanup guidance recommends scanning with Malwarebytes. Although the guide describes this as a one-time free option, Malwarebytes Free lets you continue running manual scans and removing detected malware after the Premium trial ends. The trial provides additional features, including real-time protection, so decide what is best for you.
From reporting threats to removing them.
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
