NIKKE PC Launcher Served Malicious Code via Tampered CDN Scripts

Details have emerged about a malicious code incident affecting the PC launcher for the Korean game Goddess of Victory: Nikke. The disclosed timeline points to four official JavaScript files distributed through the Level Infinite CDN. Those files were altered around September 27, 2026. Active attacks started on October 23, 2026 and continued through November 3, 2026. Anyone who opened the PC launcher during that window may have received a trojan. The PC launcher is a common path for playing the game on desktop.

Tampered JavaScript files in the CDN chain

The compromise focused on four JavaScript files hosted on the Level Infinite CDN, the distribution channel used by the game’s official launcher. These scripts load during normal launcher operation, which gave the attacker a route to deliver additional malicious components to user devices. The date of the file alterations in late September 2026 is roughly a month before the first observed attack activity in late October. That gap suggests the tampered files were already being served before the attack operator began using them. The disclosed information does not identify the method used to change the CDN files or the party behind the modification.

The game client itself is not described in the disclosure as having been directly altered. The described infection path runs through the CDN scripts and the launcher. Users who opened the launcher between October 23 and November 3, 2026 are the group at risk. The window extends across a period when players would routinely open the launcher for updates, events, or daily login. No user count or infection estimate has been provided. The four JavaScript files are the only modified files named in the disclosure. A modification of this type can remain unnoticed because the files are fetched from a CDN during startup and the change does not require a separate download by the player.

What the trojan can do

The malware carries a broad set of data theft and control functions. It steals passwords saved in browsers, credentials kept in Windows Credential Manager, SSH keys, and access tokens for cloud services or AI services. These types of data can give an attacker long-term access to accounts beyond the game itself, including developer infrastructure or personal cloud storage. The trojan also targets cryptocurrency users by pulling data from 28 browser-based cryptocurrency wallets. On systems where those wallets are installed, this extends the potential financial impact of an infection.

Beyond theft, the trojan can execute arbitrary commands, read files, and take screenshots. That means the operator can interact with an infected machine directly, retrieve documents or configuration files, and monitor what is displayed on screen. The combination of credential theft, wallet extraction, and remote command execution turns a game launcher compromise into a broader endpoint security problem for affected users. Affected users may need to review game accounts and any online services whose credentials were stored on the same machine.

How to check debug.log

The disclosure provides a specific step for users who may have opened the launcher during the attack window. The check involves the game folder and a file named debug.log. Inside that file, users should look for a field called k2f_chan. If k2f_chan appears and shows the value ‘registered’, the recommended response is to uninstall the game immediately and run an antivirus scan on the system. This log entry appears to be the main indicator made available to players.

The disclosure does not describe a separate process for cases where k2f_chan is not found. Users who ran the launcher in the October 23 to November 3 window but do not see that field should still watch for unusual activity on associated accounts and consider running a malware scan as a precaution. Because debug.log is a local file, the check can be completed without additional tools. Security teams may also recommend checking for signs of command execution or unauthorized processes if the log check confirms an infection. The incident highlights the risk of compromised distribution channels even when the game installation itself is obtained from official sources.