The developers of Goddess of Victory: NIKKE have confirmed that third parties may have tampered with scripts in the game’s PC launcher. The publisher said a client fix and update were released on November 4 at approximately 02:30 UTC+9, while an investigation into the incident’s impact continues.

The company has not shared further technical details. Independent security researcher MotherSphere reported on GitHub that four JavaScript files hosted on Level Infinite’s content delivery network were altered to download additional code when players opened the launcher. The researcher said the files had been modified on September 27, 2026.

An analysis by BleepingComputer found that two of the files contained obfuscated code designed to fetch and run further scripts from attacker-controlled domains. MotherSphere said the downloaded code used the launcher to run a LuaJIT payload that installed a remote-access tool identified as K2F.

According to the researcher’s analysis, the backdoor could let attackers run commands remotely, browse and download files, take screenshots, collect NIKKE account credentials and obtain information stored in browsers. A separate Windows DLL could also be installed and remain active after the launcher was closed. Analysis of a DLL sample indicated that it could target cryptocurrency wallet data in browser extensions, including recovery phrases and private keys. It is not known whether that component was deployed on affected systems or whether any cryptocurrency was stolen.

MotherSphere said Level Infinite replaced three affected JavaScript files on November 3, but claimed a modified version of the fourth was still being served at 22:26 GMT. The researcher also identified a possible infection indicator: the string “k2f_chan” in the game’s Launcher/intl_service/debug.log file. Its presence indicates that the Lua agent ran, but does not establish whether the DLL was also loaded.

BleepingComputer reported that the backup domain associated with the scripts was later serving a multilingual warning telling players to close the launcher and not reopen the PC client until the publisher confirmed the issue was resolved. The warning was not an official publisher announcement, and it is unclear who controls the domain or when the malicious code was replaced.

Players who may have been affected should run a full scan with updated antivirus software. The report recommends that anyone who finds evidence of compromise reinstall Windows and change passwords and other sensitive credentials from a clean device.

Sources: BleepingComputer.