NIKKE launcher reportedly poisoned, trojan targets AI tool credentials

Players and independent researchers have found that files served from the official CDN and loaded by the PC launcher for Goddess of Victory: NIKKE were tampered with. An analysis report published on GitHub on November 3 says the implanted loader downloads and runs a remote-access trojan, and that affected machines should be treated as fully compromised.

As of InvenGlobal's report, neither the developer, SHIFT UP, nor the publisher, Level Infinite, had responded publicly. Every date below comes from outside analysis; there is no official notice to check it against.

The timeline, and two places where the accounts differ

InvenGlobal's timeline runs as follows. On September 27, the attacker's code entered three official JavaScript files on the CDN, which the launcher loads when it opens. On October 28, the third file was cleaned up at the source. From November 1 at the latest, opening the launcher could download and run the remote-access program, though not on every launch. On November 3, two of the files were replaced at 17:04 and 17:21 GMT; the attacker's server stopped responding at 18:31; and at 18:59 two CDN nodes were still serving the altered copies.

The GitHub report differs somewhat. It mentions four official assets, of which two, FeedList and vue-bucket, are confirmed, and it says that when rechecked on November 4 all four had returned to clean versions. In that report, September 27 is the day the control domain insightjs.com was re-registered after about five years of dormancy. The report also notes that the payload ran only about 37 days after the loader was in place, so players who opened the launcher during that window may not have seen anything unusual.

Why would a game trojan want Claude Code configuration?

According to the report, the trojan has 19 commands covering arbitrary command execution, an interactive shell, file transfer, screenshots and credential harvesting. Its collection paths number roughly 1,790 and name AI and developer tools including Claude Code, Gemini CLI, Cursor, Windsurf and MCP configurations. It also goes after API keys and OAuth tokens for AI providers, cloud keys, package-registry tokens, CI and Kubernetes credentials, SSH and GPG keys, browser sessions, and data from 28 crypto-wallet extensions.

The list closely resembles last month's LiteLLM poisoning incident. On October 21, a tampered LiteLLM 1.107.0 was published to PyPI; that stealer also went after browser credentials and cloud keys, and Wiz disclosed that the attacker began validating the stolen AWS credentials within hours. The two incidents entered through very different doors, one through a developer's dependencies and the other through a player's game launcher, yet what they want is largely the same. Developers' local configuration files often hold plaintext keys, and those keys can be turned straight into compute credits and cloud resources; in the LiteLLM case, once the attacker had validated the credentials, it went on to list the models available on Bedrock.

The report is explicit that several things are not confirmed: how the attacker obtained write access to the CDN, the actual scale of infection, and whether other assets were contaminated over the same period. Its author also says the malicious second-stage script was not independently recovered, and that the K2F branding and certificate details in the code cannot be used for attribution. There is currently no evidence that this incident is connected to the LiteLLM case.

Checking and responding

Users who have played the PC version can check as follows:

1. Open debug.log in the Launcher/intl_service folder inside the NIKKE install directory and search for k2f_chan. If the string appears, the remote-access program may have run.
2. Until an official fix is confirmed, do not start the PC launcher, and clear its cache before using it again.
3. If you find traces, isolate the machine and preserve evidence first, then use a clean device to change passwords, sign out of all sessions, and revoke API tokens and SSH keys.
4. Wallet seed phrases cannot be fixed by rotation: create a new wallet and move the assets over.

The report also warns that the trojan can reinstall its own loader, so judging by file hashes alone is unreliable, and that you should not simply delete the entire Chrome directory.

Sources: an independent analysis report on GitHub, InvenGlobal, CocoLoop; the two sources give different counts of affected files, the scale of infection and the attack entry point are both unconfirmed, and the companies have not yet responded.