The team behind Goddess of Victory: NIKKE will release a further security update for the game's PC launcher on 12 November, after a supply-chain attack last month turned the launcher into a delivery route for data-stealing malware. The announcement, made on 10 November, comes as independent researchers warn that the launcher still has unresolved security weaknesses.

Publisher Level Infinite said the update will strengthen integrity and source authenticity checks across the whole launcher process, from resource transmission to downloading and execution. The company says security measures completed on 4 November stopped further malware distribution through the launcher, and the PC launcher has resumed normal service. But it warns that malicious software may still be present on computers that ran the launcher before those measures were in place.

How the launcher was hijacked

Attackers tampered with four JavaScript files hosted on Level Infinite's official content delivery network. According to the publisher, a domain previously used for some game services, insightjs.com, was hijacked on 27 September, and the four files were modified that afternoon to load malicious code from it whenever players opened the launcher.

The injected code fetched a LuaJIT payload called insight.bundle, which installed a remote-access agent researchers have named K2F. The backdoor could run commands on a player's computer, browse and download local files, capture screenshots, collect NIKKE account credentials and steal information stored in web browsers. It could also install a Windows DLL, platform_experience_helper.dll, that kept running after the launcher was closed. Analysis of that file found code aimed at stealing cryptocurrency wallet data, including recovery phrases and private keys, from browser extensions such as MetaMask, Phantom and Coinbase Wallet. It is not known whether the component was deployed on infected systems or whether any cryptocurrency was actually stolen.

Malware began reaching players' computers in late October. Level Infinite identified the problem on 4 November, replaced the tampered files and issued a client update. A built-in security check was added to the launcher on 5 November to detect and remove the malicious software.

What players should do

Anyone who opened the Windows PC launcher at least once since 15:41 on 27 September should run the security check. The launcher now checks automatically when it starts, and a pop-up appears if malware is found, prompting the player to remove it. Level Infinite recommends closing all web browsers before starting the check, and says that if no pop-up appears within two minutes, the computer should be free of malware distributed through the launcher. Players are also advised to change passwords, API keys and access tokens on any affected computer, and to contact customer support if they believe they were affected.

Mobile players are not affected and do not need to run the check. The game, developed by South Korean studio Shift Up, has been downloaded more than 45 million times since its launch in 2022. Level Infinite has not said how many players were affected or what data was taken.

Researchers say flaws remain

Independent researchers say the 12 November update is welcome but not the end of the story. On 10 November, researcher MotherSphere said an independent review had confirmed remaining weaknesses in the current launcher, some of them serious, and that an additional finding had been submitted. Technical details are being kept private while Level Infinite has time to fix them.

Researcher whyKusanagi, who first documented the attack, had already sent a full report on unresolved launcher weaknesses to Level Infinite and to national computer emergency response teams in Singapore, South Korea, Japan and the United States, with a 30-day deadline for fixes. The researcher continues to recommend blocking the launcher's built-in browser, tbs_browser.exe, in Windows Firewall as an interim safeguard, and says the team has not yet replied to the outstanding issues.

The concern is that the launcher could be attacked again through its remaining weaknesses, even though the original malware delivery has stopped. Level Infinite says it will keep monitoring the launcher's security and add further protections where necessary. Until the full picture is published, players who used the PC launcher in the affected window should treat the security check as essential, not optional.