EXPLORINEER
en

JP — ITmedia

Popular game NIKKE's official PC launcher reportedly used to run malicious program; scripts tampered with on CDN, users urged to take action

Security2 min read

The makers of the popular game NIKKE say that some script files in the PC launcher were changed by outsiders. This could have let harmful programs run when players opened the launcher, and players are asked to run security checks now.

What happened

The NIKKE team said on November 5 that some script files in the PC launcher (the app used to start the game) were changed by a third party. When the launcher started, a harmful program could run. The team apologized. A outside researcher reported that the changed script could send a program called K2F, which lets someone control a PC from far away and steal passwords. The team fixed the launcher on November 4 and gave players the fixed version.

Key numbers and facts

  • September 27: a web domain used by the game service was taken over. Four script files were changed the same day.
  • October 30: the harmful program started reaching player PCs through the script.
  • November 4: the team noticed the problem around midnight and blocked the extra spread that morning.
  • Players who started the Windows launcher at least once since September 27 are asked to run checks.
  • The mobile version was not affected.

Background

NIKKE is a shooting role-playing game made in South Korea by SHIFT UP. Tencent's game brand Level Infinite runs it around the world. The game sold more than 45 million downloads by October 2024. Almost half of its sales, 48.3%, came from players in Japan, according to Sensor Tower data from May 2026.

Why it matters

A game launcher is trusted software, so a change to it can put a whole PC at risk. Attackers could steal saved passwords, login data, and crypto wallet data. Some users think the team was slow to share news and did not do enough to help. Others say the team is also a victim. The case shows why game companies must check the files they load from outside servers.

What to watch

  • Whether the team finds how the attackers got into the network and how far the damage reached.
  • How the team pays players for lost money or account harm, as it has promised.
  • Whether the planned fixes, such as stronger checks on outside files, are put in place.
  • Whether the team gives more details about the harmful program.

Glossary

K2F
A harmful program that lets an attacker control a PC from far away and steal data.
Level Infinite
Tencent's game brand that publishes and runs NIKKE outside Korea.
SHIFT UP
The South Korean company that made the game NIKKE.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

Security전자신문

[Photo] Financial Sector Grim After String of Security Incidents

Cho Yong-byoung, chairman of the Korea Federation of Banks, appeared deep in thought on the 5th at the Financial Security Institute in Yeouido, Seoul, before a financial-sector-wide meeting on reforming security systems for the AI era. The photo accompanies coverage of a series of recent security incidents affecting the industry.

SecurityArs Technica

Hackers exploited iOS and Android flaws to infect phones

Hackers possibly linked to the Kremlin used previously patched iOS and Android flaws to attack visitors of multiple websites, including one marking the 250th anniversary of the US Constitution, researchers said. The attackers, assessed with moderate to high confidence as part of Russia's Foreign Intelligence Service, injected JavaScript that profiled devices and delivered payloads aimed at stealing browser cookies and, in some cases, Wi-Fi passwords and mobile device data. Impersonated sites included america250.org, which the attackers proxied through a lookalike domain.

SecurityThe Register

Apple turns iCloud into spy cloud, will start looking at public share links

Apple plans to scan publicly accessible iCloud share links, created with the "Anyone with the Link" option, for "harmful content," according to a support page published Tuesday. The company has not defined what counts as harmful, has not explained how the checks will work, and says it can remove content or involve law enforcement. The checks are slated to begin with iOS, iPadOS, macOS and visionOS 27.3, which is in developer beta with general release expected in December.

SecurityTechCrunch

Hackers stole DreamHost customer files and inboxes during months-long attack

Web host DreamHost confirmed that hackers stole customer emails and credentials during a months-long cyberattack that began in August. The company disclosed the breach after an outage lasting several days, during which it reset some customer passwords. DreamHost said attackers exploited an unspecified vulnerability in its file manager and obtained session tokens, and that the number of affected customers is "well under 10%."