Nikke PC launcher compromised to install a remote-access tool

The PC launcher for Goddess of Victory: Nikke, a popular mobile and PC game, loaded tampered files from its publisher's servers for more than a month, and from late October could install a remote-access agent on players' computers, according to an analysis by players and independent researchers. The game's team said on 4 November that it had found the launcher's script files "may have been tampered with by a third party", pushed client fixes and an update at about 02:30 Korean time (17:30 UTC on 3 November) and is investigating the scope. Nikke is developed by Shift Up and published on PC by Tencent's Level Infinite.

How it worked

Four official JavaScript files on Level Infinite's content delivery network were modified on 27 September, according to a public write-up built from one infected machine and checked against other victims' logs. The launcher's embedded browser loads those files, and from 23 October at the latest some launches fetched a remote-control agent. While the launcher stayed open, the operator could run commands, download files, take screenshots and pull saved passwords, browser cookies, developer credentials and crypto wallet data. On Windows the agent also registered a DLL that Chrome loads, so it kept running after the launcher closed.

The write-up says three of the files were replaced on 3 November, while the fourth was cleaned at the origin on 28 October but was still being served by two CDN servers that evening. How the attacker got write access to the CDN is not known. Researchers have also published a tool and a checker to show whether a machine ran the agent. Gaming outlet AUTOMATON reported the compromise before the official notice. Players have said other Level Infinite launchers could be affected, but no one has shown that, and Level Infinite has not commented.

Check and clean up

Anyone who opened the Nikke PC launcher since late September should treat the machine as possibly compromised. The write-up's main test is to search Launcher/intl_service/debug.log in the Nikke folder for k2f_chan; a hit means the agent ran. It recommends blocking insightjs.com, analytics.insightjs.com, insightjs.org, 89.127.233.127 and 89.126.250.172, and deleting the launcher cache at %APPDATA%\nikke_launcher\tbs_cache before opening it again, because it can still hold the modified files. On infected Windows machines it says to delete the registry key HKCU\Software\Classes\CLSID\{E77CC89B-7401-4C04-8CED-149DB35ADD04} (not the HKLM copy, which belongs to Windows), restart, and remove the DLL folder under Chrome's PlatformExperienceHelper directory.

Because the agent could read browser passwords and session cookies, infected users should change passwords from a clean device, sign out of sessions everywhere and treat developer keys and wallet recovery phrases on the machine as exposed. Rebuilding Windows is the safest option. The Nikke team has said a separate notice on follow-up measures will come.