Hackers turned the NIKKE PC game launcher into a password thief

If you play Goddess of Victory: NIKKE on a Windows PC, the game's launcher may have been quietly turned against you. The developers confirmed that hackers tampered with the launcher's script files. A security researcher says the altered files could install spyware that steals logins and cryptocurrency wallet data.

What happened

This is called a supply-chain attack. Instead of tricking players one by one, attackers slip bad code into something the company itself hands out. Players then receive it from an official source. The researcher, who goes by MotherSphere, says four JavaScript files on the publisher's official content delivery network were changed on September 27, 2026. Each time a player opened the launcher, the hidden code reached out to attacker-controlled websites and downloaded more code.

The game's developers posted on X that a client update went out on November 4 at about 02:30 (UTC+9). They said they are still investigating how far the problem reaches and will share more in a separate notice.

What the malware could do

According to the researcher, the downloaded code installed a remote-access tool called K2F. That kind of tool lets an attacker control a computer from afar. It could do the following:

• Run commands on the computer
• Browse and download files
• Take screenshots
• Collect NIKKE account logins and information saved in web browsers

A second piece, a Windows file named platform_experience_helper.dll, could keep running even after the launcher was closed. BleepingComputer found code in a sample of it aimed at wallet add-ons such as MetaMask, Phantom and Coinbase Wallet, including recovery phrases and private keys. It is not known whether attackers actually installed this piece on any computer, or whether anyone lost crypto.

Is the problem over?

Not clearly. The researcher says three of the four files were replaced with clean versions on November 3. A tampered copy of the fourth was reportedly still being served as of 22:26 GMT. So a bad file may have stayed online after the fix. One of the attacker websites now shows a warning telling players to close the launcher, but the message says it is not from the publisher, so it is unclear who controls that site now.

Who is affected

The reports describe the PC launcher on Windows. NIKKE also runs on iOS and Android, but the material does not say those versions were involved. The publisher, Level Infinite, reports more than 45 million downloads since 2022, though no one has said how many players opened the tampered launcher. Level Infinite had not answered BleepingComputer's request for comment at publication.

What to do

The steps are in the alert box above, including how to check your computer for signs of infection. Treat a hit on that check seriously, since it means the spyware ran. Anyone who finds it should assume passwords and wallets are exposed.

What happens next

Watch for the publisher's promised follow-up notice. It should explain how many players were affected and whether the launcher is safe to open again.