An analysis has revealed that the PC launcher for 'Goddess of Victory: Nikke', developed by SHIFT UP and published by Level Infinite, was exploited as a malware distribution vector by hackers. According to player reports and a technical report by an independent security researcher, several files automatically downloaded from the official Content Delivery Network (CDN) servers upon starting the launcher were tampered with. As a result, concerns have been raised that remote-control malware may have secretly executed on the systems of some users who ran the game on PC.
The suspicions began when users on the Chinese gaming community NGA noticed unusual activity. A report published on code-sharing platform GitHub on November 3 analyzed that commands loading external malware had been covertly injected into four official Level Infinite server files on September 27. All four are files that automatically run whenever the 'Nikke' PC launcher is launched. The report explained that starting as early as October 24, launching the client could result in a hacker's remote-control program being installed and executed on the PC. The researcher added that for safety reasons, they did not execute the malware binary itself, but analyzed its code structure only.
According to the report, while the 'Nikke' launcher is open, the malware allows an attacker to remotely execute commands on the user's PC, search for and exfiltrate files, and capture screen grabs. Target credentials include stored browser passwords, 'Nikke' account information, and data from 28 types of cryptocurrency wallets.
In addition, it targets SSH security keys and cloud access credentials commonly used by developers. However, the report noted that it does not harvest all general passwords stored in Windows, but is structured to read only information related to development tools. On Windows PCs, it can secretly register itself to the Chrome browser, allowing it to continue running even after the game launcher is closed. Users on Linux and Steam Deck running the game via the Proton compatibility layer are also exposed to the same risk.
Three Files Replaced; Tampered Versions Remain on Some Servers
Three of the four compromised files were replaced with clean files between 2:04 AM and 2:21 AM KST on November 4. The remaining file was previously modified on the origin server on October 28; however, the report pointed out that as of 7:26 AM on November 4, two regional distribution servers were still delivering the tampered file. How the hacker gained authorization to modify files on the official content delivery servers and the actual extent of user damage remain unknown.
To quickly check if a PC is infected, the researcher advised users to open the log file (Launcher/intl_service/debug.log) inside the 'Nikke' installation folder and search for the string 'k2f_chan'. The presence of this string indicates traces of malware execution. However, the absence of this record does not guarantee safety. The researcher urged players to refrain from running the PC launcher until an official resolution announcement is made by the developer, and to clear the temporary cache folder before launching it again in the future. If infection is suspected, users should change passwords for major sites from an uncompromised, secure device (such as a smartphone) and terminate all active sessions. It is also safer to immediately transfer cryptocurrency assets to a newly created wallet and revoke developer security keys. On Taiwanese gaming forum Bahamut, user reports have emerged confirming the same traces found in the logs of multiple Japanese server players.
PC Launcher Suspicions Raised Immediately Following 4th Anniversary Update
'Goddess of Victory: Nikke' launched its 4th anniversary update worldwide on October 29. The malware suspicions were discovered only in files loaded by the PC launcher. Mobile apps played on smartphones or tablets were not part of this analysis, and the report alone cannot confirm whether mobile environments are affected.
As of the morning of November 4, no official statement has been posted on either company's official channels.
