Supply‑Chain Attack Compromises NIKKE PC Game Launcher, Deploys Remote‑Access and Crypto‑Stealing Malware
What Happened — On September 27 2026, attackers altered four JavaScript files hosted on Level Infinite’s official CDN that are used by the PC launcher for Goddess of Victory: NIKKE. The modified scripts download additional code from attacker‑controlled domains (insightjs.com / insightjs.org). That code loads a LuaJIT payload (insight.bundle) which installs a remote‑access agent (K2F) and a malicious DLL (platform_experience_helper.dll). The backdoor enables command execution, file browsing, screenshot capture, theft of NIKKE account credentials, browser‑saved passwords, and cryptocurrency wallet data. The breach was disclosed on 4 Nov 2026, and a client update was pushed the same day to replace the compromised scripts.
Why It Matters for Trust & Control Assurance — The incident highlights the need for continuous verification of third‑party code and supply‑chain monitoring to satisfy a core control objective around vendor oversight.
Who Is Affected — Gaming publishers, CDN providers, and the millions of end‑users who installed the compromised launcher (estimated >45 M downloads).
Recommended Actions
- Enforce integrity checks (code signing, hash verification) on all third‑party assets before deployment.
- Deploy network monitoring to detect unexpected outbound connections from launchers.
- Update incident‑response playbooks to include supply‑chain compromise scenarios and evidence‑preservation steps.
Technical Notes
- Attack vector: malicious JavaScript injected into CDN‑hosted launcher files (supply‑chain / third‑party dependency).
- Malware capabilities: remote‑access agent (K2F), credential theft, crypto‑wallet harvesting, persistent DLL.
- No CVE was disclosed; the flaw resides in the lack of integrity validation for the launcher scripts.