Concerns are growing among game fans following analysis indicating that launching the 'Goddess of Victory: Nikke' PC launcher may have allowed PCs to be remotely controlled. Official server files loaded by the game launcher were tampered with, creating a major security vulnerability. Because this issue occurred through no fault of the players themselves, anxiety is heightened over whether individual systems have already been infected.
A detailed technical report by GitHub user 'MotherSphere' analyzing the situation served as the foundation for verifying the problem and formulating countermeasures. Based on that report, we have summarized the core details to make them easier to understand.
Tampering of 4 Official Server Files in the Launcher How Files Turned into Remote Control Tools
First, let's look at the launcher. As the gateway passed before launching the game, players naturally run it to play. Every time the launcher is opened, it downloads and executes several JavaScript files from official servers. In simple terms, it is structured so that the launcher fetches fresh components needed for operation from an official warehouse each time.
A Content Delivery Network (CDN) plays the role of this warehouse. It is a distribution network that replicates the same files across multiple regional servers to deliver files quickly to users worldwide. The starting point of this incident was the alteration of four files hosted on Level Infinite's official CDN.
The modified files are aegis-fix.min.js, vue-bucket.min.js, images.7fec4c32.js, and FeedList.feb647c9.js. According to server logs, the report explains that all of them were modified within a span of just over a minute between 6:41 and 6:42 GMT on September 27.
The method of modification was simple. Short commands were inserted into normal files so that when the launcher executed them, it would simultaneously load a script from an external address set up by the attacker (insightjs.com). The address was obscured as an array of numbers rather than plain text, and it was designed to retry by changing the domain extension to .org if the address was blocked. In particular, the added ~700 bytes in FeedList.feb647c9.js were placed right before the closing syntax rather than at the very end of the file. The report explains that this location is easily missed by checks that only compare file ends.
The next step is downloading. Using the launcher's built-in download function, the loaded script fetches a file named 'insight.bundle' from the attacker's server. This file is saved inside the launcher folder with a .log extension—making it look like a log file—where it is executed and immediately deleted.
What gets downloaded and executed is a remote-control agent. Rather than a program that steals information once and exits, it functions as a remote administration tool that periodically connects to a server while awaiting commands from the attacker. This makes it far more dangerous. On a PC analyzed in the report, it connected to the server approximately every 30 minutes, with a margin of error around 6 minutes.
This agent only operates while the launcher is open. However, players frequently leave the launcher running in the system tray while gaming, and the report cites an instance where an agent connected to the server 22 times over a 9-hour period. The problem lies in the scope of what this agent can do.
How Far Does the Risk Extend? What Can the Agent Do?
The core command among those an attacker can send is 'exec'. It executes any program and returns the results, meaning that anything the user's account can do, the attacker can do as well. Installing additional malware, reading documents, and modifying files are all possible. The remaining commands can be described as shortcuts built to make using these capabilities more convenient.
There is a wide variety of shortcut commands. These include commands to browse folders and download files, capture screenshots across monitors, and exfiltrate credentials stored in Windows Credential Manager. Commands to read passwords saved in Google Chrome, Edge, Brave, Vivaldi, Opera, and Firefox, as well as commands to gather information from 28 types of browser-extension cryptocurrency wallets, were also included. There were also commands to collect basic system details such as computer name, username, Windows version, storage devices, and network adapters.
Added to this is a feature that automatically scans 264 file paths. The list is packed with items familiar to developers: SSH (Secure Shell) keys for remote access, configuration files for GitHub, Docker, and Kubernetes, cloud access credentials for Amazon Web Services and Google Cloud, as well as authentication files for AI coding tools such as Claude Code, Codex, and Gemini command-line tools. Command histories and .env configuration files in project folders are also targeted. Essentially, any file readable by the user account falls within the risk scope.
The report also noted that a flag disabling cookie collection was present in the agent configuration. However, this value was merely an option within the browser information scan command, and even when disabled, saved passwords are still read as usual. Cookies are used to maintain login sessions without entering passwords, and since cookie files can be copied in their entirety via file access commands, this does not mean cookies were safe.
Another issue is that identifying damage is difficult. The command to execute a new program is limited to 'exec', while all other commands are processed directly inside the launcher process. As a result, no trace is left in Windows program execution history (Prefetch) or process creation logs. Command histories are not recorded in launcher logs either, making it impossible for users to verify which commands the attacker issued.
If Chrome is installed on Windows, there is an additional risk. The agent installs a DLL loaded by Chrome via a 'chrome_install' command, and this DLL continues to operate whenever Chrome is launched even after the launcher is closed. The report notes that this DLL reads passwords entered on web pages and cryptocurrency wallet recovery phrases, though this section was categorized as a user-reported finding that could not be directly verified at the time. While not definitively confirmed, serious concerns remain.
Furthermore, cases where Microsoft Defender Offline Scan failed to detect this DLL were included in the report, making it hard to feel secure based solely on a clean antivirus scan. Additionally, the DLL appears to be generated uniquely for each victim, meaning it cannot be identified by file hashes alone and must be located via folder paths and registry keys.
Users running Nikke via Proton on Linux and Steam Deck are not safe either. While Windows-targeted auto-collection paths are mostly empty in Proton environments, Wine—which Proton relies on—mounts the Linux home directory as a drive. Consequently, remote commands can read SSH keys, browser profiles, and configuration files containing API keys inside the home folder. Environment variables are also passed verbatim to the agent, meaning users must assume that all secrets in the home directory and environment variables have been exposed, according to the report. The Chrome DLL hijacking mechanism applies only to Windows.
Tampering Lasted Over 5 Weeks From September to November Replacement
So what is the timeline of events so far? The earliest confirmed record dates back to September 27. At 01:59 GMT, the insightjs.com domain used as the attacker's server was registered, and nearly five hours later, at 06:41 GMT, official CDN files began to be altered.
Subsequently, the report identified the agent's operation starting time as October 24 at the latest. On October 28, FeedList.feb647c9.js was restored to a clean file at the server origin, but the remaining three files remained tampered with until November 3.
Public warnings emerged on November 3. The report notes that a post in the Nikke community Discord at 16:11 GMT was the first public warning. Following this, aegis-fix.min.js at 17:04, vue-bucket.min.js at 17:13, and images.7fec4c32.js at 17:21 GMT were sequentially replaced with legitimate files.
The attacker's server also changed during the same period. At 17:30 GMT, the script loaded by the tampered files was replaced with a file resembling a page speed analytics script that lacked download functionality, and by 18:31 GMT, the server was no longer accessible from the researcher's PC. However, insight.bundle remained downloadable as of 17:30 GMT.
The remaining issue involves FeedList.feb647c9.js. Even though the origin file was fixed on October 28, two CDN servers were still serving the modified version as late as 22:26 GMT on November 3. The report explains that sending fresh requests by appending arbitrary parameters to the URL still returned the tampered file.
However, fixing the server files does not remove the agent or Chrome DLL if they are already installed. Because tampered files may also persist in the launcher cache on user PCs, the report advises clearing the cache folder before launching the launcher again.
Under these circumstances, are Level Infinite's other games safe? The damage confirmed in reports and coverage so far is limited to the Nikke PC launcher. No evidence has emerged indicating that other game launchers were compromised in the same manner.
However, there is also no basis to definitively confirm safety. The tampered files were hosted on Level Infinite's official CDN rather than a Nikke-exclusive server, and how the attacker gained access to this storage or deployment pipeline remains unknown. Whether this access was limited to Nikke or extended across Level Infinite as a whole remains a critical unknown. The report also pointed out that other files in the same repository might have been modified, stressing the need to compare them against build artifacts.
Circumstantial evidence exists. Two of the four tampered files were located in a Nikke-specific folder with 'nikke_launcher' in the path, but the remaining two resided in a folder that appears to be a shared library with no reference to Nikke (comm/assets/lib). Furthermore, the report noted that a temporary file initially listed as an indicator of compromise—before being corrected—was found with the same name and content in a September 20 Delta Force Wine environment prior to the tampering. The report concluded that this file was created by Tencent software rather than being evidence of infection. While Nikke and Delta Force appear to share certain Tencent software components, whether they load the same CDN files remains unconfirmed. This underscores the need for swift verification at the company level.
There are counter-indicators as well. The agent clearly shows signs of being tailored specifically for Nikke, such as targeting the Nikke launcher folder for data collection and storing status information at a Nikke-launcher-specific endpoint. While it seems unlikely to function as-is against other game launchers, this merely reflects the limitations of this specific payload rather than the extent of the attacker's system access.
Meanwhile, the insightjs.org domain reserved as a fallback by the attacker has already passed into third-party hands. At 17:55 GMT on November 3, a third party registered this domain and replaced it with a Nikke PC launcher security warning page.
Is My PC Infected? What to Do Now From Verification to Blocking, Removal, and Password Reset
So what steps should players take?
The first step is checking for infection. Although tampered files could be delivered to anyone opening the launcher, the actual malware payload was downloaded in only a fraction of executions. The report mentions a case where the agent was downloaded only 3 times across approximately 19 launcher runs on a single user's system.
To check whether your PC is affected, open 'Launcher/intl_service/debug.log' inside the Nikke installation folder and search for 'k2f_chan'. Finding this string indicates that the agent has executed. If you deleted the folder or reinstalled the game, the logs will be gone; in that case, check for 'k2f.agent' inside the files in '%APPDATA%\nikke_launcher\tbs_cache\Local Storage\leveldb'.
The report recommends three actions for all users. First, do not run the Nikke PC launcher until Level Infinite officially confirms a fix. Second, delete the launcher cache folder at '%APPDATA%\nikke_launcher\tbs_cache' before running it again. Proton users should delete the corresponding path inside their Proton environment.
Third, block the attacker's addresses. The three domains (insightjs.com, analytics.insightjs.com, and insightjs.org) should be blocked via the hosts file, router, or firewall, while the IP address 89.127.233.127 must be blocked at the router or firewall level. This is because the hosts file redirects domain names and cannot block bare IP addresses. However, since this only blocks current servers, the report notes with concern that it will be ineffective if the attacker retries using a new domain.
To edit the hosts file, run Notepad as administrator, open 'C:\Windows\System32\drivers\etc\hosts', and add the three domains at the bottom—one per line—formatted like '0.0.0.0 insightjs.com', then save.
If you suspect your PC is already infected, the order of operations is crucial. First, close the launcher or disconnect from the internet to block attacker access. If Chrome is installed on Windows, delete the registry key 'HKCU\Software\Classes\CLSID\{E77CC89B-7401-4C04-8CED-149DB35ADD04}' first, then restart Windows.
To modify the registry, open 'Registry Editor' via Windows Search, navigate to the path above, select the key, and delete it. Take care not to delete other keys with similar names.
Next, inside the 'PlatformExperienceHelper' directory in Chrome's User Data folder, find subfolders with 64-character alphanumeric names and delete only the one containing 'platform_experience_helper.dll'. Do not delete the PlatformExperienceHelper folder itself, as it is a legitimate folder created by Chrome. Also, because the same CLSID exists as a legitimate entry under HKLM on all Windows systems, delete only the key under HKCU. A system restart is required because the DLL may remain locked even after closing all Chrome windows.
The report highlights a clean Windows reinstallation as the safest resolution, as the attacker could execute arbitrary commands while the agent was active.
Instead of the Chrome DLL cleanup procedure, Linux and Steam Deck users should assume all secrets stored in home directories and environment variables have been compromised and proceed to reset passwords, SSH keys, and API tokens.
Subsequent recovery steps should be performed on an uninfected device. Change your Nikke and Level Infinite account passwords first, followed by email, Discord, banking, and all browser-saved passwords. Enable two-factor authentication (2FA) and log out of active sessions on services like Discord, Google, Steam, and GitHub, since stolen cookies can grant access without a password. Developers should revoke and regenerate API tokens and SSH keys for platforms such as GitHub and AWS, while cryptocurrency funds should be transferred to a new wallet generated with a fresh seed phrase.
Note that these measures are based on the researcher's report; once official guidance from the publisher is released, players should follow those official instructions.
Infection Without User Fault Concerns and Remaining Challenges
The most concerning aspect of this incident is that it occurred without any user fault. Victims did not download suspicious files or execute software from unknown sources; rather, official files fetched by the official launcher from official servers were altered. This vector makes prior detection virtually impossible for players.
Another grave concern is that damage may not be limited to gaming accounts. Because targeted data included developer keys, cloud access credentials, and AI coding tool authentication files, any system used for gaming that also contains work-related credentials could extend the compromise to corporate environments.
Much remains unknown. How the attacker gained write access to Level Infinite's CDN has not been confirmed. The report posits that the attacker obtained access to the CDN repository or the deployment pipeline uploading files there, warning that unless this access path is identified and blocked, altered files could be uploaded again using new domains.
The true scale of damage and data exfiltration also remains unverified. As noted earlier, because command histories leave no trace in logs, any PC with confirmed infection must assume the worst-case scenario. This underscores the urgent need for a swift investigation and response from Level Infinite, the publisher overseeing the service.
