Summary of Malicious Program Distribution via Goddess of Victory: NIKKE PC Launcher

The PC launcher for the game "Goddess of Victory: NIKKE" was compromised via a supply chain attack involving tampered script files on the official CDN between September 27 and November 4, 2026. The altered scripts installed a remote access agent named K2F capable of executing arbitrary commands and stealing credentials from browsers, cryptocurrency wallets, and cloud services. The malware persisted by injecting a DLL into Chrome to intercept wallet recovery phrases. The initial compromise stemmed from domain hijacking of insightjs.com. The vendor detected and remediated the issue by replacing files and deploying automated detection and removal on November 5. Users who ran the Windows PC launcher during the compromise window were potentially affected.

• Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party ScriptCampaign2026-10-30
• Fake iPhone Duo preorder scam triggers DarkSword attackMalware2026-09-29
• Binance heist: what we know, and what we see in TraderTraitor's toolkitMalware2026-11-05
• Poisoned Source: APT29 Watering Holes Targets Mobile DevicesMalware2026-11-04
• From Business Emails to XLoader: An Order Lure That Led to In-Memory InjectionMalware2026-11-04