The Windows version of an action RPG game called Goddess of Victory: Nikke seems to have been hacked to secretly serve malware to unsuspecting users.
The developers of the game posted a tweet, alluding to the threat. “We have identified an issue indicating that the PC Launcher’s script files may have been tampered with by a third party,” it said.
The developers refrained from mentioning details, only that a fix started rolling on Wednesday. “We are currently investigating the scope of the impact caused by this issue, and we will provide further details regarding follow-up measures in a separate notice,” the tweet added.
UPDATE: The developers are now apologizing for failing to provide a secure service, and say: “we have prepared in-game compensation for all Commanders.” In a tweet, they added: “If you have launched the Windows PC launcher at least once since September 27, 15:41 (UTC+9), we ask that you perform a security check and take any necessary measures.” The game has released a guide with more instructions.
This comes after an internet user named MotherSphere documented evidence about the malware circulating through the game’s launcher. “From Oct 23 at the latest, opening the launcher could install a remote-control agent: while the launcher was open, the attacker could run any command on your machine, read any file and take screenshots,” the report warned.
The game Goddess of Victory: Nikke isn’t available on Steam, but through its own Windows-based executable launcher from the official website. It looks like the same launcher was fetching the tampered Javascript files from the game’s publisher, Tencent’s Level Infinite.
According to MotherSphere, four Javascript files for the game were modified with to contain malicious computer code. The hacker seems to have done so by infiltrating a content delivery network server from Level Infinite, and adding the malicious payload on September 27th.
MotherSphere’s research found the malware only targeted some victim machines, not all. But if the malware installs, it can also steal passwords, loot cookies from the user’s browsers, and plunder cryptowallet information.
MotherSphere says users can manually check if they were affected by opening their Nikke install folder, opening “Launcher/intl_service/debug.log” in a text editor, and searching for “k2f_chan.” The presence of the k2f_chan indicates the malware ran over the PC. Some users have reported finding the k2f_chan in the log file. If you are infected, it’s recommended to reinstall Windows just to be safe.
It’s also possible for the malware to target Linux and Steam Deck devices if the game was run over the Proton compatibility layer, MotherSphere added. Although the game’s developer did clean the four tampered Javascript files, MotherSphere still warned: “None of this undoes anything on machines that were already infected…. Before you open the launcher again, delete its cache folder %APPDATA%nikke_launchertbs_cache (inside your prefix on Proton), because it can still hold the modified files and the launcher would load them again.”
Goddess of Victory: Nikke is also available for Android and iOS. In 2024, the game reported crossing 45 million downloads worldwide.
Story via Uk Pcmag. Read the original article
