An analysis indicates that the PC launcher for 'Goddess of Victory: Nikke', developed by Shift Up and published by Level Infinite, was exploited as a distribution vector for malware. According to reports from players and a technical analysis by an independent security researcher, several files automatically downloaded from the official content delivery network (CDN) servers when launching the client were tampered with by an unknown party. As a result, concerns have been raised that remote-control malware may have secretly executed on the systems of some users who ran the game on PC.

Suspicions first arose when users on the Chinese gaming forum NGA noticed unusual activity. A report published on the code-sharing platform GitHub on November 3 revealed that malicious commands designed to load external malware were secretly embedded into four files on Level Infinite's official servers on September 27. All four files execute automatically whenever the 'Nikke' PC launcher is launched. The report explained that, at the latest by October 24, a hacker's remote access tool could be installed and executed on PCs during the launcher startup process. The researcher added that for safety reasons, they did not execute the malware payload itself and analyzed only its code structure.

According to the report, while the 'Nikke' launcher remains open, the malware allows attackers to remotely issue commands to the victim's PC, search for and exfiltrate files, and capture screenshots without authorization. Target data for theft includes credentials saved in web browsers, 'Nikke' account details, and information from 28 types of cryptocurrency wallets.

The malware also targets SSH security keys and cloud access credentials frequently used by developers. However, the report noted that it does not harvest all general passwords saved on Windows, but is structured specifically to extract information associated with development tools. Notably on Windows PCs, it can stealthily register itself within Chrome browsers to continue running even after the game launcher is closed. Linux and Steam Deck users running the game via compatibility software (Proton) face the same risk exposure.

Three Files Replaced, Tampered Copies Remain on Some Servers

Three of the four compromised files were replaced with clean files between 2:04 AM and 2:21 AM KST on November 4. The report highlighted that while the remaining file was cleaned on the origin server earlier on October 28, two regional CDN servers were still delivering the altered file as late as 7:26 AM on November 4. How the attackers obtained authorization to modify files on official distribution servers, as well as the actual scope of user damage, remains unknown.

To quickly check for PC infection, the researcher advised users to open the log file (`Launcher/intl_service/debug.log`) located in the 'Nikke' installation directory and search for the string 'k2f_chan'. Finding this string indicates traces of malware execution. However, the absence of this entry does not guarantee safety. The researcher urged players to refrain from running the PC launcher until an official fix is announced by the publisher, and to clear the launcher cache prior to any future launch. If infection is suspected, users should change passwords for major services and log out of all active sessions from a separate, secure device (such as a smartphone). Transferring cryptocurrency to a newly created wallet and revoking developer security keys is also strongly recommended. On Taiwanese gaming forum Bahamut, users have reported finding identical traces in logs from multiple players on Japanese servers.

PC Launcher Allegations Surface Right After 4th Anniversary Update

'Goddess of Victory: Nikke' launched its global 4th anniversary update on October 29. The malware allegations are strictly limited to files loaded by the PC version's launcher. Mobile applications played on smartphones or tablets were not part of this analysis, and the report cannot confirm whether mobile environments are impacted.

As of the morning of November 4, neither company has released an official statement on their official channels.