The operator of the hit game Goddess of Victory: NIKKE said on November 5 that part of the script files in its PC launcher had been altered by a third party, and that malicious programs may have run when the launcher started. The team apologized and told users to take countermeasures.
NIKKE is a shooting RPG for smartphones and PC developed by South Korea's SHIFT UP and published globally by Level Infinite, the game brand of China's Tencent. The operator has not disclosed details of the malicious program. Outside researchers identified it as "K2F," which can give an attacker remote control of a PC and the chance to steal passwords, according to their warnings.
The operator fixed the client and pushed an update at about 2:30 a.m. on November 4, then distributed the corrected launcher and notified users afterward. Anyone who started the Windows launcher even once since 3:41 p.m. on September 27 is being asked to run a security check using the official PC client's functions.
Users are also being asked to change, from a safe PC, any password they used on the affected machine, and to discard and reissue API keys and access tokens. The operator further recommends a full antivirus scan and a Microsoft Defender offline scan. It is apologizing with in-game items and other gifts, and directing anyone whose accounts outside the game show anomalies or who has suffered financial damage to customer support.
Domain seized, four scripts rewritten
The apology posted on the game's official X account carries the name of Tencent's Level Infinite team, which handles distribution, not developer SHIFT UP. It says the tampering may have caused malicious programs to run when the launcher started, and that the launcher now being distributed has been fixed and works normally.
According to the account the operator published, the domain insightjs.com, used by part of the game service, was taken over by a third party at 10:59 a.m. on September 27. Between 3:41 and 3:42 p.m. the same day, four script files that the launcher loads from the official CDN were altered, with malicious code inserted that connects to a specific domain.
Before the operator's announcement, a researcher named MotherSphere had been studying and publishing on the problem. MotherSphere reported that four official JavaScript files on the CDN had been put in a state where they loaded scripts from an external site. The operator's announcement says distribution of the malicious program to users' PCs through those scripts began at 3:52 a.m. on October 30.
MotherSphere warned that the program is K2F, which allows an attacker to operate the machine remotely. Remote control carries the risk that passwords and login credentials (cookies) saved in the browser and cryptocurrency wallet data are stolen, or that social media and other accounts are accessed without authorization.
Operator noticed on November 4
The operator noticed the anomaly at about midnight on November 4. Between 2:04 and 2:23 a.m. it replaced three of the malicious files and blocked further distribution, and by 12:09 p.m. it had finished updating the CDN cache tied to the remaining file.
The team is checking the security of its network environment, including the CDN, to identify how the files were altered, and is also investigating the scope of the impact. As preventive measures it lists stronger monitoring of the launcher and related systems, a mechanism to verify the integrity of external resources the launcher loads, and a review to limit each launcher function's permissions to the minimum necessary.
How to check a PC
The operator has prepared an inspection guide and is asking players to check their PCs. Tencent's anti-cheat and security feature ACE (Anti-Cheat Expert), built into the PC client, gained the ability to detect and remove this malicious program from 8 a.m. on November 5, and the guide walks users through a check using it. Because some malicious files may not be deleted if a browser is running during the check, users are told to close browsers such as Chrome completely first.
For people who do not have the launcher installed, the operator also published a manual check, which runs through many steps and is fairly complex: find the launcher's log file, examine its contents, and delete the malicious registry entries. In a manual check, the string "k2f_chan registered" in the launcher log means the malicious program may have run.
After removing the program, users should change the passwords of accounts used on that PC, and discard and reissue any API keys or access tokens stored on it. The operator recommends doing this work on the checked PC or on another device that was not affected, and finishing with a full antivirus scan and a Microsoft Defender offline scan. The mobile version was not affected and needs no check.
NIKKE was released on November 4, 2022, and marked its fourth anniversary on November 4. At its second anniversary it claimed more than 45 million downloads worldwide, as of the end of October 2024. In a tally by US firm Sensor Tower in May, Japanese users accounted for 48.3 percent of revenue, the largest share of any country.
On X, some users criticized the response, saying the information came out slowly and that the handling and compensation were insufficient when users' entire PCs were put at risk. Others expressed understanding, calling the operator a victim too.