NIKKE PC Launcher Compromised in Supply-Chain Attack, Exposing Player Data
Attackers compromised the PC launcher for the popular game Goddess of Victory: NIKKE, embedding malicious code that could steal player credentials, passwords, and cryptocurrency data.
Players of the popular game Goddess of Victory: NIKKE are facing potential data exposure following a sophisticated supply-chain attack that compromised the game's official PC launcher. The attackers successfully injected malicious code into JavaScript files hosted on the game publisher's content delivery network (CDN), allowing a remote-control agent to execute when unsuspecting players launched the game.
This incident, identified by independent researcher MotherSphere, involved tampering with legitimate game files, meaning players did not need to download suspicious software or visit malicious websites. The compromise allowed the embedded malware to potentially access and steal a wide range of sensitive information, including NIKKE account credentials, saved browser passwords, API tokens, and even cryptocurrency wallet data.
Publisher Level Infinite confirmed the breach and has since released fixes for the PC client, including a new malware-checking feature. However, the company acknowledges that these fixes do not undo any infection that may have already occurred or recover data that was potentially stolen. The timeline of the attack is also under scrutiny, with Level Infinite stating malicious activity began on October 30, while MotherSphere's analysis suggests the remote-control agent was active as early as October 23.
The remote-control agent deployed by the attackers was capable of a broad spectrum of malicious actions. Its functionalities included running arbitrary programs and system commands, browsing file directories, downloading files, capturing screenshots, and crucially, retrieving saved login credentials for NIKKE and web browsers. Furthermore, the malware was designed to search for developer credentials, API tokens, and other secrets, as well as collect data from cryptocurrency wallet extensions.
The full extent of the compromise, including the number of affected PCs and the precise amount of data stolen, remains unclear. Level Infinite has advised affected players to close the launcher, scan their PCs from a clean device, and secure all online accounts. It is critical that users do not change passwords on a potentially compromised machine.
For players who may have had their cryptocurrency wallets exposed, Level Infinite strongly recommends using a clean device to transfer funds to a newly created wallet with a fresh recovery phrase. The company has also urged anyone who believes they were affected, particularly those experiencing issues with external accounts or financial losses, to contact their customer support team and retain relevant records.
Mobile-only players of Goddess of Victory: NIKKE are not affected by this incident and do not need to take any additional security measures. Level Infinite has stated that all identified malicious script files were replaced and the CDN cache refreshed on November 4, with subsequent checks confirming the files are now clean.
This supply-chain attack highlights the persistent risks associated with compromised third-party services and the importance of vigilant security practices, even when interacting with seemingly trusted software. Players are encouraged to follow the official guidance from Level Infinite and utilize reputable security software for thorough system scans.