The developers of Goddess of Victory: NIKKE have confirmed that launcher script files for the PC version “may have been tampered with by a third party,” and a researcher says the modified files delivered a remote-access agent called K2F. The game has more than 45 million downloads, and the publisher has not disclosed how many players were affected.
Shift Up Confirms NIKKE Launcher Tampering and Pushes a Client Update
Shift Up, the studio behind the game, said on X that the launcher scripts may have been altered. The company issued a client update at about 02:30 (UTC+9) on Wednesday and said the scope is still under investigation. Level Infinite is the publisher. A backup domain now displays a warning telling players to close the launcher, and the publisher has promised further notice.
Four JavaScript Files on Level Infinite’s CDN Were Modified on 27 September
Researcher MotherSphere, who publishes on GitHub, reports that four JavaScript files on Level Infinite’s official content delivery network were modified on 27 September 2026. The changes injected an obfuscated loader that fetches code from the domains insightjs[.]com and insightjs[.]org. If the timing is correct, players were exposed for roughly six weeks.
The researcher says three of the four files were replaced with clean versions on 3 November, but a tampered fourth file was still being served as of 22:26 GMT that day.
The K2F Remote-Access Agent Arrives as a LuaJIT Bundle
The payload is a LuaJIT bundle named insight.bundle, which installs a remote-access agent called K2F. K2F can run commands, browse and download files, capture screenshots, and steal NIKKE credentials and browser data.
An Optional DLL Targets MetaMask, Phantom and Coinbase Wallet
An optional DLL, platform_experience_helper.dll, persists after the launcher closes. Analysis of a VirusTotal sample shows it targets wallet extensions including MetaMask, Phantom and Coinbase Wallet, where it seeks recovery phrases and private keys. It remains unknown whether the DLL was actually delivered to any players or whether any cryptocurrency was stolen.
The k2f_chan String in debug.log Marks Affected Installs
The researcher identified one local indicator of compromise: the string k2f_chan in the file Launcher/intl_service/debug.log. Its presence would point to a launcher that ran the injected code.
MotherSphere’s account places the first modification on 27 September, which would put the exposure at roughly six weeks before the 4 November notice. The warning on the backup domain tells players to close the launcher, an indication the publisher regards the running launcher as the risk.
The publisher has not said whether it found that indicator on player machines, and it has not described the investigation’s findings so far. The partial cleanup on 3 November, with one tampered file still live hours afterward, shows the replacement of files on the CDN took place in stages rather than at once.
Level Infinite’s Trusted CDN Became the Delivery Mechanism for K2F
The incident places malicious code on a vendor-controlled CDN, the channel players trust to deliver launcher updates. Players did not have to download anything from an unofficial source or open an attachment; running the official launcher was enough to load the altered scripts.
K2F’s capabilities cover credential theft, file access and screenshots, and the wallet-targeting DLL adds a financial motive. Because the DLL persists after the launcher closes, a player who ran the launcher during the exposure period could still carry its effects after closing the game.
Several basic questions remain open: how attackers gained write access to the CDN, how many installs pulled the modified files, and whether the DLL was ever distributed. Shift Up and Level Infinite have not addressed those points, and the researcher’s account of the 27 September modification date is so far the only timeline for when the tampering began.
