NIKKE PC Launcher Tampering Delivered Remote-Access Malware Through Official CDN

The developers of Goddess of Victory: NIKKE confirmed tampering with the game's Windows PC launcher scripts and released a corrective update. Researcher MotherSphere reported that four JavaScript files on publisher Level Infinite's official CDN were modified on September 27 to retrieve malicious code from insightjs[.]com and insightjs[.]org. The reported infection chain used LuaJIT to deploy the K2F remote-access agent, with the earliest reported agent execution on October 23. An optional Windows DLL could steal cryptocurrency wallet recovery phrases and private keys, but its deployment and any resulting cryptocurrency theft have not been confirmed.

The update was issued around November 3 at 17:30 UTC, although MotherSphere reported that one compromised script remained available after other files were replaced. The scope remains under investigation: exposure to a modified script does not establish successful malware execution, and the reports do not establish that every player was infected or that Android users or other Tencent games were affected. vx-underground also questioned the lack of publicly shared malware samples. Reported persistence indicators include a Windows user-registry CLSID entry and a file named platform_experience_helper.dll beneath a Chrome PlatformExperienceHelper subfolder. Systems showing execution or persistence indicators should be isolated and investigated, with evidence preserved and potentially exposed accounts secured from a trusted device; updating the launcher alone does not establish removal of an earlier infection.