A compromised software update pipeline has delivered a combination of remote-access and data-stealing malware to players of the PC version of Goddess of Victory: NIKKE, turning a trusted auto-update mechanism into a distribution channel for malicious code.
BleepingComputer reported that the game's developers confirmed attackers modified the launcher scripts distributed to PC users, embedding payloads capable of harvesting saved credentials and cryptocurrency wallet data. The report does not name a threat actor suspected of carrying out the intrusion, and no attribution to a specific group has been published.
How the compromise worked
Rather than targeting players directly through phishing or malicious downloads, the attackers altered files that the launcher itself pulls down during its normal update routine. Because those files arrive through an official, trusted channel and execute with the permissions the launcher already holds, the tampering bypasses the caution users typically apply to unsolicited software.
Once executed, the payload reportedly installs dual-purpose malware: a remote-access trojan that gives an attacker persistent interactive control over the infected machine, and an infostealer that sweeps browser-stored passwords, session tokens, and cryptocurrency wallet files. The pairing is particularly damaging — the stealer supplies the material for account takeover and fraud, while the RAT provides a foothold that survives beyond the initial theft.
Exposure is limited to users who fetched the compromised update during the affected period, before corrected launcher files were put in place. Anyone who updated outside that window, or who has since obtained a clean launcher, is not considered impacted by this specific incident.
Why launcher pipelines matter
Update mechanisms are high-value infrastructure, not a routine convenience. Software that quietly replaces its own components on a schedule is, by design, exempt from much of the friction that protects users elsewhere: no prompt, no manual signature check, and a strong expectation that what arrives is legitimate.
That design has been exploited repeatedly. Supply-chain intrusions such as the 3CX desktop application compromise — in which a signed installer was poisoned to fetch additional malicious components — and the XZ Utils backdoor, which hid malicious code inside a widely depended-upon compression library, share a common trait: the attacker compromises the build or delivery step rather than the end user, so every downstream consumer inherits the risk simultaneously. The NIKKE launcher case follows the same pattern on a consumer software distribution channel.
What affected users should do
Recommended remediation for anyone who ran the affected launcher build includes rotating saved passwords for the game account and any other accounts reusing the same credentials, revoking active browser and application sessions, migrating cryptocurrency holdings to a freshly created wallet rather than attempting to clean an exposed one, and running a full malware scan after removing and reinstalling the launcher from an official source.
The wider lesson for IT teams
For organisations in Hong Kong and elsewhere that manage fleets of corporate endpoints, the relevant point is not the game itself but the delivery path. Consumer-grade launchers, plugin managers, and auto-update agents installed on staff machines operate with the same trusted-pipeline privileges as enterprise software, yet are frequently maintained to a lower standard of build integrity, signing, and provenance checking.
Treating third-party update channels as an enterprise security control — inventorying which applications self-update, verifying that those channels are signed and integrity-checked, and monitoring the resulting file changes — is a low-cost measure against a class of attacks that increasingly targets the pipeline rather than the perimeter.
Source: BleepingComputer
一條被入侵的軟件更新 pipeline 已向《勝利女神：NIKKE》PC 版玩家投放遠端存取及資料竊取惡意軟件，令原本受信任的自動更新機制淪為散播惡意代碼的渠道。
BleepingComputer 報導，遊戲開發商證實黑客修改了分發予 PC 用戶的啟動器腳本，植入能夠竊取已儲存憑證及加密貨幣錢包資料的 payload。報道並未指出懷疑發動入侵的 threat actor，亦未有任何歸因至特定組織的資料公布。
入侵手法
黑客並非透過釣魚或惡意下載直接攻擊玩家，而是篡改啟動器在例行更新時自行下載的檔案。由於這些檔案經官方可信渠道傳送，並以啟動器既有的權限執行，此種篡改繞過了用戶對非邀請軟件通常抱持的警惕。
據報導，payload 執行後會安裝雙重用途惡意軟件：一款 remote-access trojan（RAT），讓黑客對受感染電腦維持持久互動控制；以及一款 infostealer，搜刮瀏覽器儲存的密碼、session token 及加密貨幣錢包檔案。兩者相配尤具破壞性——infostealer 提供帳戶接管及詐騙所需的材料，而 RAT 則提供超越首次竊取後仍可持續存在的立足點。
受影響範圍僅限於在修訂版啟動器檔案部署前、於受影響期間下載了被入侵更新的用戶。凡在該時段以外更新，或其後已取得乾淨啟動器者，均不被視為受此事件影響。
為何啟動器 pipeline 值得重視
更新機制屬高價值基礎設施，而非一般便利功能。按時自行替換元件的軟件，在設計上已獲豁免於保護用戶的多項防護摩擦：毋須提示、毋須手動核對簽章，並強烈預設傳抵的內容屬合法。
此設計已屢遭利用。諸如 3CX 桌面應用程式入侵事件——當中經簽章的安裝程式被植入惡意程序，用以下載額外惡意元件——以及在廣泛倚賴的壓縮函式庫中藏匿惡意代碼的 XZ Utils 後門，均具共通特徵：黑客入侵的是 build 或交付環節而非最終用戶，故所有下游使用者同時承受風險。NIKKE 啟動器事件正是同一模式在消費者軟件分發渠道的翻版。
受影響用戶應採取的措施
建議曾執行受影響啟動器版本的用戶進行以下補救：輪換遊戲帳戶及任何重用相同憑證的其他帳戶的已儲存密碼、撤銷現有的瀏覽器及應用程式 session、將加密貨幣轉移至新創建的錢包（而非試圖清理已外洩的錢包），並從官方來源移除並重新安裝啟動器後，執行全面惡意軟件掃描。
對 IT 團隊的更廣泛啟示
對於香港及其他地區管理大量企業端點的機構而言，關鍵並非遊戲本身，而是交付路徑。安裝在員工電腦上的消費者級啟動器、plugin manager 及自動更新代理程式，與企業級軟件享有同等的可信 pipeline 權限，然而其 build 完整性、簽章及來源查核標準往往較低。
將第三方更新渠道納入企業安全管控——清點哪些應用程式會自行更新、核實該等渠道經簽章及完整性檢查，並監察由此產生的檔案變更——是一項低成本措施，足以對付日益針對 pipeline 而非邊界的攻擊類別。
來源：BleepingComputer