NIKKE PC launcher compromise exposed players’ passwords and files

Independent researcher MotherSphere identified malicious JavaScript files hosted on Level Infinite’s official CDN that were used to tamper with the NIKKE PC launcher, triggering a supply‑chain style compromise. Level Infinite acknowledged that malicious-program distribution began on October 30, while MotherSphere’s analysis cites evidence of the remote‑control agent running as early as October 23.

The distributed agent reportedly supported commands to run programs and system commands, browse folders and download files, take screenshots, retrieve saved NIKKE login credentials, collect browser passwords and cookies, search for developer credentials and API tokens, and even harvest cryptocurrency wallet‑extension data. The full extent of affected machines and data exfiltration remains unclear.

Level Infinite has issued fixes and added a malware‑checking feature to the official PC client, and says mobile users were not affected. In practice, fixing the delivery mechanism does not undo any infections or restore passwords that may have already been stolen. The publisher replaced three abnormal script files on 4 November and refreshed the CDN cache for the remaining file the same day; MotherSphere later reported that all four files were clean on the CDN servers checked.

For players who opened the Windows launcher during the identified window, the recommended steps include closing the launcher, scanning with Malwarebytes and following NIKKE’s removal guidance, securing accounts from a clean device (and not changing passwords on a potentially compromised machine), and, if a crypto wallet or recovery phrase was exposed, moving funds from a newly created wallet with a new recovery phrase. Per Level Infinite, affected players should contact customer support and retain relevant records.