---
id: "CMP-202611-noobki"
kind: "campaign"
aliases: []
title: "Goddess of Victory: NIKKE PC launcher served a remote-access stealer from tampered scripts on publisher Level Infinite's CDN"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Goddess of Victory: NIKKE PC launcher", "fixed": [], "affected": "launcher runs from 2026-10-23 to 2026-11-04", "ecosystem": "windows"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-04T17:05:35+00:00"
updated_at: "2026-11-04T17:07:17+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-04T17:05:35+00:00"}]
---

# Goddess of Victory: NIKKE PC launcher served a remote-access stealer from tampered scripts on publisher Level Infinite's CDN

Four JavaScript files for the Goddess of Victory: NIKKE PC launcher, hosted on publisher Level Infinite's (Tencent) CDN, were altered (file timestamps 27 Sep 2026). When the launcher starts, the injected code loads a second script from an external domain, which uses the launcher's own download function to fetch and run a Lua-based remote-access tool. The tool runs commands, downloads files, takes screenshots, and steals NIKKE logins, browser passwords and session cookies, SSH keys, API tokens and data from crypto wallet extensions (28 wallet types). On Windows it installs a DLL that Chrome loads, so it keeps running after the launcher closes. Windows PCs and Linux/Steam Deck via Proton are affected. The earliest reported run was 23 Oct 2026 (some reports say 24 Oct). Independent researcher MotherSphere published the analysis on GitHub on 3 Nov. The NIKKE team confirmed third-party tampering with launcher scripts and pushed a client fix on 4 Nov around 02:30 UTC+9. Shift Up's CEO apologised. As of 22:26 UTC, two CDN servers were still serving an altered FeedList.feb647c9.js. How the CDN was breached and how many players were hit are unknown. The external domain and hashes are not given in the sources we read.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- windows:Goddess of Victory: NIKKE PC launcher affected launcher runs from 2026-10-23 to 2026-11-04 fixed ?

## How to check

Without opening the launcher, look in Launcher/intl_service/debug.log under the NIKKE install folder for a 'k2f_chan' entry; if it is there, the remote-access tool ran. A missing entry does not prove you are clean, especially after a reinstall or log cleanup. Anyone who opened the NIKKE PC launcher (Windows or Proton/Steam Deck) on or after 23 Oct 2026 is at risk. Check Chrome for an unknown DLL being loaded. Watch for a launcher-cached FeedList.feb647c9.js.

## Fix

Keep the NIKKE PC launcher closed until Level Infinite confirms the fix, and clear the launcher's browser cache before reopening it. If k2f_chan shows up, or you can't rule it out: disconnect the PC; from a clean device, change saved browser passwords and the NIKKE account password, revoke active sessions, rotate API tokens, cloud credentials and SSH keys, and move crypto wallet funds to new addresses. Reinstall the operating system, because the attacker could have installed more malware. Developers who game on their work machines should treat their keys as exposed.

## Timeline

- 2026-11-04T17:05:35+00:00 analyst

## Documents

- [describes] @BleepinComputer: NIKKE PC game launcher hacked to spread remote access, data-stealing malware
htt https://x.com/BleepinComputer/status/2118025248251547670
- [describes] @vxunderground: Still lots of yapping from anime nerds about this NIKKE launcher malware thing.
 https://x.com/vxunderground/status/2118023701337678081
- [describes] NIKKE PC launcher delivered malware that let hackers control players' computers https://cyberinsider.com/nikke-pc-launcher-malware-remote-access-tool/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_