General Gaming News and Discussion

Malakriss

Avatar of War Slayer
13,394
12,742

Apparently a malware actor gained access to Level Infinite's CDN and hooked stuff into their PC launchers for games that updated recently. If you played NIKKE at all in the last couple weeks you are likely compromised. (PC versions, mobile doesn't use the launchers)

edit: some users claimed other game launchers from Level Infinite had initial entries and first stage files but nothing provided to analysts, so either fearmongering or not widespread.
- Goddess of Victory Nikke
- PUBG Mobile
- Delta Force
- Honor of Kings
- Arena Breakout
- Dune Awakening
- Age of Empire Mobile
- Undawn

(Forum keeps converting link to wall of text)
Code:
https://gist.github.com/MotherSphere/d6c049a09ba8ac3085c51ee9df24a4e5
From 2026-09-27, four official JavaScript files on Level Infinite's CDN contained attacker code. The NIKKE PC launcher loads these files. From Oct 23 at the latest, opening the launcher could install a remote-control agent: while the launcher was open, the attacker could run any command on your machine, read any file and take screenshots.
 
Last edited:
  • 1WTF
  • 1Seriously?
Reactions: 1 users

Kajiimagi

<Aristocrat╭ರ_•́>
6,639
11,323
Apparently a malware actor gained access to Level Infinite's CDN and hooked stuff into their PC launchers for games that updated recently. If you played these at all in the last couple weeks you are likely compromised (PC versions, mobile doesn't use the launchers)
- Goddess of Victory Nikke
- PUBG Mobile
- Delta Force
- Honor of Kings
- Arena Breakout
- Dune Awakening
- Age of Empire Mobile
- Undawn

(Forum keeps converting link to wall of text)
Code:
https://gist.github.com/MotherSphere/d6c049a09ba8ac3085c51ee9df24a4e5
and so it begins
 

Malakriss

Avatar of War Slayer
13,394
12,742
Where are you finding this extra info? All I can find is shit about Nikke online
There's no official post by Shiftup (Nikke has now tweeted to acknowledge), Tencent, or Level Infinite yet so it's self-reports from people playing games that use their launcher and having some of the preliminary debug and files showing up. Nikke looks like the primary target with various levels of remote access and data pulls, passwords and crypto wallets associated with browsers. Lots of partial installs have been reported where some search strings and connections don't show up but the initial stage of compromised files are still present and need to be purged obviously. Attacker entries may be cached locally after a game uninstall so there are extra things to clean.

Timeline so far is Sep 27 CDN was compromised, sites and certificates were registered in early Oct but they waited for the Nikke anniversary and backdoor agent connections happened around the Oct 23 - Nov 3 time period.

 
Last edited: