Supply‑Chain Compromise of NIKKE PC Launcher Exposes Player Passwords and Personal Files

What happened

Attackers compromised four JavaScript files hosted on Level Infinite’s official CDN. The malicious code transformed the NIKKE PC launcher into a remote‑control agent capable of executing system commands, browsing folders, taking screenshots, and exfiltrating saved game credentials, browser passwords, cookies, API tokens, and cryptocurrency‑wallet information. The malicious distribution began on October 23, 2026, and continued until Level Infinite replaced the files and refreshed the CDN cache on November 4, 2026. Players who opened the launcher during this window may have had data stolen or remain infected.

Why it matters for trust and compliance

• The incident demonstrates why continuous third‑party risk monitoring and supply‑chain integrity checks are essential control objectives for audit readiness.
• Provides evidence for supply‑chain risk controls required by multiple frameworks (e.g., NIST CSF, ISO 27001).
• Enables continuous monitoring of third‑party assets to generate defensible audit evidence.

Who is affected

Recommended actions

1. Verify the launcher’s hash against the official checksum and reinstall if needed.
2. Change all game‑related and reused passwords from a clean device.
3. Run reputable anti‑malware scans and follow the publisher’s removal instructions.
4. Adopt a supply‑chain validation program (code signing, hash verification, CDN integrity monitoring) and retain logs for audit purposes.