The PC launcher for Goddess of Victory: NIKKE, one of South Korea’s biggest game exports, was hijacked in a supply-chain attack that turned the game’s official distribution path into a delivery route for malware capable of stealing passwords and cryptocurrency wallet data.

Four JavaScript files downloaded by the launcher from publisher Level Infinite’s content delivery network were altered on 27 September 2026. The compromised files remained in circulation for more than five weeks. Level Infinite puts the start of malware distribution at 30 October, while independent researcher MotherSphere’s analysis cites evidence of the remote-access agent running as early as 23 October. The publisher replaced the altered files on 4 November and released a fixed client the same day.

What the malware could steal

The altered files could install a remote-access tool called K2F, capable of collecting browser passwords, session cookies, developer credentials and data from 28 browser cryptocurrency wallet extensions, including MetaMask, Phantom and Coinbase Wallet, according to MotherSphere’s analysis. A Windows DLL, platform_experience_helper.dll, could keep running after the launcher was closed. Neither developer Shift Up nor Level Infinite, a Tencent Holdings unit, has disclosed how many PCs were infected or whether any cryptocurrency was stolen.

Level Infinite said it introduced a malware detection and removal feature in the PC client at 8 a.m. on Thursday 5 November, and has apologised for the incident. It urged all users who launched the Windows PC launcher at least once after 27 September to conduct a security check, including searching launcher logs for the string “k2f_chan registered”. The mobile version of the game was not affected.

Sources: Aju Press, Nikke falls latest prey to cyberattacks on Korean entities, 5 November 2026; InvenGlobal, Level Infinite Apologizes for Nikke PC Launcher Issue, Accepts Reports of Secondary Damages, 5 November 2026.