Players of Goddess of Victory: NIKKE did not have to download anything suspicious to get infected. They only had to open the game's official Windows launcher. Attackers tampered with files the launcher loads from publisher Level Infinite's content delivery network (CDN), turning trusted software into a way to drop a remote-control agent on gamers' PCs, Malwarebytes reports.
This is a supply-chain attack in the plainest sense: nobody had to be tricked into installing a fake game or a shady add-on. The publisher has shipped fixes and added a malware-checking feature to the PC client, but a cleaned launcher does not remove malware already running, or recover passwords that may already be gone.
Four poisoned scripts on the official CDN
Independent researcher MotherSphere identified malicious code in four JavaScript files hosted on Level Infinite's official CDN. According to the researcher's analysis, the agent it distributed could:
- run programs and system commands, browse folders and download files, and take screenshots;
- retrieve saved NIKKE login credentials;
- collect browser passwords and cookies;
- search for developer credentials, API tokens and other secrets;
- collect data from cryptocurrency wallet extensions.
That reach goes well beyond a game account. A gamer who also writes code on the same machine could lose cloud keys and tokens, the kind of material that infostealers increasingly go after. How many PCs were compromised, and how much data was actually taken, remains unclear.
The timelines do not agree
Level Infinite says distribution of the malicious program began on October 30. MotherSphere reports evidence of the remote-control agent running as early as October 23, a week earlier. Anyone who opened the Windows launcher in that wider window should treat their PC as potentially affected.
Level Infinite says it replaced three abnormal script files early on November 4 and refreshed the CDN cache for the remaining file later that day. MotherSphere subsequently reported that all four files were clean on the four CDN servers it checked. Mobile-only players are not affected, according to the publisher.
Clean the PC first, then change passwords elsewhere
If you opened the NIKKE Windows launcher since late October:
- Close the launcher and scan the PC. MotherSphere's report includes user-reported Malwarebytes detections for traces tied to the attack. Follow the removal instructions NIKKE has published carefully.
- Change passwords from a clean device, not from the machine that may still be compromised.
- If a crypto wallet or its recovery phrase could have been exposed, use a clean device to move funds to a newly created wallet with a new recovery phrase.
- Contact Level Infinite customer support if you see problems with external accounts or financial losses, keeping records but not handing over personal information.
Fixing the delivery pipe was the publisher's job, and it has done that. Finding out whether the pipe already delivered something to your machine is still yours.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.