NIKKE Windows launcher compromised through publisher's content network, putting player credentials at risk
- Severity
- High
- Sources
- 1
What happened
Researcher MotherSphere found malicious code in four JavaScript files on Level Infinite's CDN, loaded by the NIKKE Windows launcher, with no CVE assigned. The remote-control agent supports command execution, file browsing and download, screenshots, and theft of NIKKE credentials, browser passwords and cookies, developer credentials and API tokens, and crypto wallet extension data. Timelines differ: Level Infinite says distribution began 30 October, while MotherSphere saw the agent running from 23 October. Defenders should check endpoints that ran the launcher in that window, follow the publisher's removal guidance, and rotate credentials from a clean device.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check your PC if you opened the NIKKE Windows launcher during the period identified in the reporting, and close the launcher first.
- Follow the NIKKE removal instructions published by the publisher carefully.
- Change your account passwords from a clean device rather than the possibly compromised PC.
- If a cryptocurrency wallet or its recovery phrase may have been exposed, move funds from a clean device to a newly created wallet with a new recovery phrase.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Products