In a report by Bleeping Computer, developers of the popular sci-fi shooter Goddess of Victory: NIKKE confirmed a supply-chain attack that compromised the game's PC launcher scripts.
The breach involved the injection of malicious JavaScript into files hosted on the official content delivery network of publisher Level Infinite. By modifying these scripts, attackers enabled the download of a remote-access agent known as K2F. This backdoor granted unauthorized parties the ability to execute commands, capture screenshots and steal sensitive data, including browser-stored credentials and cryptocurrency wallet information. Security researchers identified that the malware could deploy a malicious Windows dynamic link library to intercept private keys and recovery phrases from popular browser-based wallets. While Level Infinite issued a client update on November 4 at 2:30 a.m. to address the vulnerability, reports suggest some compromised files remained accessible shortly thereafter. The incident highlights significant risks within gaming software supply chains, as attackers leveraged legitimate infrastructure to distribute malicious payloads to millions of users. Affected players are advised to perform full system scans using updated antivirus software and to change sensitive passwords from a secure device. Level Infinite has not yet provided a comprehensive statement regarding the full scope of the impact.
Source: Bleeping Computer
