NIKKE PC launcher compromised in supply-chain attack, malware pushed to players

Key points

• Modified launcher scripts were used to distribute malicious payloads to players.
• The campaign can harvest account credentials and cryptocurrency wallet data.
• Remote-access tooling may give intruders persistent control of infected PCs.
• No CVE was assigned; treat the incident as a high-severity supply-chain compromise.

The PC launcher for NIKKE has become a malware delivery channel after unknown intruders modified its scripts, according to incident details. Rather than exploiting a numbered software flaw, the attackers appear to have abused the trust players place in the game’s update and launch process, turning a routine client component into a vehicle for hostile code. No CVE identifier is associated with the event.

Players who ran or updated the launcher may be exposed to three overlapping risks: theft of login credentials, compromise of cryptocurrency wallets, and installation of tools that let an attacker operate the machine remotely. Those outcomes can lead to account takeover, loss of digital assets, and deeper intrusion into personal or corporate networks if an affected PC is used for work.

The incident fits the pattern of a supply-chain compromise: the distribution mechanism itself was tampered with, so victims did not need to visit a shady site or open a suspicious attachment. Because game launchers often run with user privileges and may persist at startup, a successful infection can be quiet and long-lived. The absence of a CVE does not reduce operational risk; it means defenders cannot rely on patch scanners alone.

K-12 and government users should treat this as a high-severity third-party software event. A personal gaming PC that also accesses district email, cloud storage or finance systems can bridge the two environments. The immediate priority is to identify endpoints with the NIKKE launcher installed, isolate suspected infections, and force credential resets from a clean device. Security teams should also watch for wallet-related transactions and unusual remote-management activity.

Watch for updated guidance from the NIKKE developers, revised launcher builds, and indicators of compromise such as unexpected startup entries, new remote-access services, or outbound connections tied to the launcher. Until the vendor publishes a clean version and verification details, block the launcher in managed environments and communicate the risk to staff and students who game on district-connected devices.

What to do now

1. Inventory endpoints for the NIKKE PC launcher and record versions; prioritize machines used for both gaming and district work.
2. Block the current launcher installer and update endpoints until the studio publishes a verified clean build.
3. Isolate hosts showing unexpected startup items, new remote-control services, or wallet-related anomalies; preserve logs before cleanup.
4. Reset credentials for affected users from a known-clean device and revoke active sessions, especially for email, SSO, and cloud storage.
5. Scan for persistence and remote-access tooling, then remove the launcher and related artifacts according to incident response guidance.
6. Warn staff and students not to run the launcher on district-connected devices; provide a reporting path for suspected infections.
7. Monitor for vendor advisories and hashes; update detection rules for launcher-related scripts and outbound traffic.

Original source

BleepingComputer