Supply-Chain Attack on NIKKE PC Launcher Delivers RAT and Info-Stealer Malware

What happened

According to BleepingComputer, the developers of the PC game Goddess of Victory: NIKKE have confirmed that attackers tampered with the game's launcher scripts in a supply-chain compromise. The modified launcher was used to distribute malware capable of providing remote access and stealing credentials and cryptocurrency wallet data. Details on the initial access vector, scope of affected users, and attribution have not been disclosed.

Why it matters

Game launchers and updaters run with the trust and often the privileges of the player's machine. That makes them an attractive distribution channel. A single compromise of a build pipeline, CDN, or update script can push malware to a large player base with no action beyond a normal launch or update. The combination of remote-access capability and credential and wallet stealing points to both persistent access and financial motivation. Anyone who ran the NIKKE PC launcher during the affected window should treat their system and stored credentials as potentially exposed.

What defenders should watch for

• Review endpoint telemetry for unexpected child processes spawned by game launcher executables, especially script interpreters (PowerShell, cmd, wscript/cscript) or network tools launched from a game installation directory.
• Hunt for outbound connections from launcher or game processes to unfamiliar or newly registered domains, particularly shortly after launcher updates.
• Look for access to or exfiltration of browser credential stores, cryptocurrency wallet files and extensions, and clipboard-monitoring behavior on hosts where the launcher was installed.
• Treat game client auto-update mechanisms as a software supply-chain risk. Monitor for unsigned or unexpectedly modified binaries and scripts, and validate launcher file hashes against known-good baselines where feasible.
• Advise affected users to run a reputable malware scan, rotate stored credentials, and move cryptocurrency assets if a compromise is suspected.

Developing story

This is a new report with limited public technical detail so far. No CVE, specific malware family name, or confirmed scope has been published. We will continue to monitor for updates. Source: BleepingComputer.