{"id":"CMP-202611-noobki","kind":"campaign","aliases":[],"related":[],"title":"Goddess of Victory: NIKKE PC launcher served a remote-access stealer from tampered scripts on publisher Level Infinite's CDN","description":null,"summary":"Four JavaScript files for the Goddess of Victory: NIKKE PC launcher, hosted on publisher Level Infinite's (Tencent) CDN, were altered (file timestamps 27 Sep 2026). When the launcher starts, the injected code loads a second script from an external domain, which uses the launcher's own download function to fetch and run a Lua-based remote-access tool. The tool runs commands, downloads files, takes screenshots, and steals NIKKE logins, browser passwords and session cookies, SSH keys, API tokens and data from crypto wallet extensions (28 wallet types). On Windows it installs a DLL that Chrome loads, so it keeps running after the launcher closes. Windows PCs and Linux/Steam Deck via Proton are affected. The earliest reported run was 23 Oct 2026 (some reports say 24 Oct). Independent researcher MotherSphere published the analysis on GitHub on 3 Nov. The NIKKE team confirmed third-party tampering with launcher scripts and pushed a client fix on 4 Nov around 02:30 UTC+9. Shift Up's CEO apologised. As of 22:26 UTC, two CDN servers were still serving an altered FeedList.feb647c9.js. How the CDN was breached and how many players were hit are unknown. The external domain and hashes are not given in the sources we read.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-04T17:05:35+00:00","products":[{"name":"Goddess of Victory: NIKKE PC launcher","fixed":[],"affected":"launcher runs from 2026-10-23 to 2026-11-04","ecosystem":"windows"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Without opening the launcher, look in Launcher/intl_service/debug.log under the NIKKE install folder for a 'k2f_chan' entry; if it is there, the remote-access tool ran. A missing entry does not prove you are clean, especially after a reinstall or log cleanup. Anyone who opened the NIKKE PC launcher (Windows or Proton/Steam Deck) on or after 23 Oct 2026 is at risk. Check Chrome for an unknown DLL being loaded. Watch for a launcher-cached FeedList.feb647c9.js.","fix":"Keep the NIKKE PC launcher closed until Level Infinite confirms the fix, and clear the launcher's browser cache before reopening it. If k2f_chan shows up, or you can't rule it out: disconnect the PC; from a clean device, change saved browser passwords and the NIKKE account password, revoke active sessions, rotate API tokens, cloud credentials and SSH keys, and move crypto wallet funds to new addresses. Reinstall the operating system, because the attacker could have installed more malware. Developers who game on their work machines should treat their keys as exposed.","status":"open","published_at":null,"first_seen_at":"2026-11-04T17:05:35+00:00","triaged_at":"2026-11-04T17:05:35+00:00","updated_at":"2026-11-04T17:07:17+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'+9':202B '-202611':23A '02':199B '2026':63B,162B '22':210B '23':160B '24':166B '26':211B '27':61B '28':126B '3':177B '30':200B '4':196B 'access':11A,97B 'affect':154B 'alter':58B,220B 'analysi':173B 'api':118B 'apologis':207B 'around':198B 'base':94B 'breach':226B 'browser':111B 'campaign':34B 'cdn':21A,56B,214B,224B 'ceo':206B 'chrome':136B 'client':193B 'close':145B 'cmp':22A 'code':70B 'command':102B 'compromise':27A 'confirm':182B 'cooki':115B 'crypto':123B 'data':121B 'deck':150B 'dll':134B 'domain':78B,237B 'download':85B,103B 'earli':36B 'earliest':156B 'early-warn':35B 'extens':125B 'extern':77B,236B 'feedlist.feb647c9.js':221B 'fetch':88B 'file':40B,59B,104B 'fix':194B 'four':38B 'function':86B 'github':175B 'given':242B 'goddess':1A,28A,43B 'hash':239B 'hit':232B 'host':49B 'independ':168B 'infinit':19A,53B 'inject':69B 'instal':132B 'javascript':39B 'keep':140B 'key':117B 'launcher':6A,26A,33A,48B,66B,82B,144B,188B 'level':18A,52B 'linux/steam':149B 'load':71B,137B 'login':110B 'lua':93B 'lua-bas':92B 'mani':229B 'motherspher':170B 'nikk':4A,46B,109B,180B 'nikke':25A,31A 'noobki':24A 'nov':178B,197B 'oct':161B,167B 'of':29A 'parti':185B 'password':112B 'pc':5A,32A,47B 'pcs':147B 'player':230B 'proton':152B 'publish':17A,51B,171B 'push':191B 'read':247B 'remot':10A,96B 'remote-access':9A,95B 'report':157B,164B 'research':169B 'run':90B,101B,141B,158B 'say':165B 'screenshot':106B 'script':15A,74B,189B 'second':73B 'sep':62B 'serv':7A,218B 'server':215B 'session':114B 'shift':203B 'sourc':245B 'ssh':116B 'start':67B 'steal':108B 'stealer':12A 'still':217B 'take':105B 'tamper':14A,186B 'team':181B 'tencent':55B 'third':184B 'third-parti':183B 'timestamp':60B 'token':119B 'tool':98B,100B 'two':213B 'type':128B 'unknown':234B 'use':80B 'utc':201B,212B 'via':151B 'victori':3A,45B 'victory':30A 'wallet':124B,127B 'warn':37B 'window':130B,146B","nicknames":["NIKKE launcher compromise"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["goddessofvictorynikkepclauncher","nikkelaunchercompromise","ofvictorynikkepclauncher"],"ptokens":["goddess","launcher","nikke","of","pc","victory"],"labels":["campaign","earlywarning","high","vendor"],"campaign_type":"supply-chain","first_public_at":"2026-11-04T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-noobki","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-04T17:05:35+00:00","fetched_at":"2026-11-04T17:05:35+00:00","note":null}],"documents":[{"id":68770,"url":"https://x.com/BleepinComputer/status/2118025248251547670","title":"@BleepinComputer: NIKKE PC game launcher hacked to spread remote access, data-stealing malware\nhtt","kind":"post","source":"x","publisher":null,"text":"NIKKE PC game launcher hacked to spread remote access, data-stealing malware\nhttps://t.co/uNhbDNNQt0\n\nhttps://t.co/uNhbDNNQt0\n\nlikes 2 reposts 0","published_at":"2026-11-04T16:59:04+00:00","relation":"describes","confidence":null,"note":null},{"id":68588,"url":"https://x.com/vxunderground/status/2118023701337678081","title":"@vxunderground: Still lots of yapping from anime nerds about this NIKKE launcher malware thing.\n","kind":"post","source":"x","publisher":null,"text":"Still lots of yapping from anime nerds about this NIKKE launcher malware thing.\n\nLots of AI slop write-ups, zero actual goopies shared, and silly \"notifications\" sent to law enforcement and federal agencies about it\n\nGod speed anime people https://t.co/fAxNV4QAsK\n\nlikes 228 reposts 4","published_at":"2026-11-04T16:52:56+00:00","relation":"describes","confidence":null,"note":null},{"id":68775,"url":"https://cyberinsider.com/nikke-pc-launcher-malware-remote-access-tool/","title":"NIKKE PC launcher delivered malware that let hackers control players' computers","kind":"blog","source":"analyst","publisher":null,"text":"Summary of MotherSphere GitHub report (Nov 3): four JavaScript files on Level Infinite's CDN for the Goddess of Victory: NIKKE PC launcher were altered (timestamps Sept 27); earliest reported malware run Oct 23. Altered scripts load a second script from an external domain that uses the launcher's download function to fetch and run a Lua-based RAT: runs commands, downloads files, screenshots, steals NIKKE logins, browser passwords, session cookies, SSH keys, API tokens, crypto wallet extension data; on Windows installs a DLL Chrome loads for persistence. Affects Windows and Proton (Linux/Steam Deck). NIKKE team confirmed possible third-party tampering, shipped client fix Nov 4 ~02:30 UTC+9. Two CDN servers still served altered FeedList.feb647c9.js at 22:26 UTC. Check: k2f_chan entry in Launcher/intl_service/debug.log under game install folder means RAT ran; missing entry inconclusive. Advice: keep launcher closed, clear launcher browser cache, from clean device change passwords, revoke sessions, rotate API tokens/SSH keys, reinstall OS on infected machines.","published_at":"2026-11-04T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}