> ## Content Index
> Fetch the complete content index at: https://espresso.cafecito.tech/llms.txt
> Use this file to discover other available public pages before exploring further.

# Domain hijack gave attackers remote control of NIKKE PC launcher, prompting password resets
- URL: https://espresso.cafecito.tech/level-infinite-nikke-launcher-malware-injection/
- Published: 2026-11-11T12:42:37.000Z
- Updated: 2026-11-11T12:42:37.000Z
- Description: A domain hijack let hackers inject malicious JavaScript into Level Infinite's NIKKE PC launcher, giving attackers remote control of affected PCs between Oct 30 and Nov 4. The patched client stops the script, but players must scan devices and change passwords.
- Author: Barista @ Cafecito
- Tags: Cybersecurity, Technology, Cybersecurity Incident, Threat Intelligence, Security Vulnerability, #cortado-77ee2255-d17d-56cc-a10b-d48aa1b312b6

Level Infinite’s PC launcher for the NIKKE game has been compromised, letting third‑party malware onto players’ machines. The publisher says the attack started when hackers hijacked a domain used to serve the launcher’s scripts, then injected malicious code. Players are being asked to scan their devices and update to a patched version that adds stricter checks.

What’s notable is that the breach isn’t just about stealing credentials—it gave attackers remote control of affected PCs. Reports from South Korea show the compromised client could execute remote‑access tools, pull passwords, cookies, and cryptocurrency wallet information, and delete files. The incident looks like a supply‑chain attack on the launcher’s delivery pipeline rather than a simple credential theft.

### How the attack chain worked

The breach began when a domain used to serve the launcher’s scripts was compromised on September 27\. Attackers then inserted malicious JavaScript into those scripts, which are fetched by the updater and installer. When a user ran the launcher, the injected script executed on their machine. The patched client continued to run the malicious script from October 30 until a fix was deployed on November 4, after which the script stopped executing. The domain was taken down on November 3, but the script had already been active for weeks.

### What users are up against

Players who updated the client between October 30 and November 4 may have malware already running. The malicious script can harvest passwords, cookies, and cryptocurrency wallet data, and it can provide remote access to the machine. That means an attacker could view or copy personal files, log into linked accounts, or attempt to steal funds. The Kotaku report notes the malware can delete files, though it’s unclear how widespread that capability was used or whether user data was actually removed. The impact isn’t limited to the game account—users’ broader digital identity is at risk.

### The patch and what comes next

Level Infinite rolled out a fix on November 4 that removes the injected script and adds stricter permission checks. The company also urges users to run a security scan and change passwords. A further update is scheduled for November 12 that will strengthen authentication checks. The patch closes the immediate injection vector, but it doesn’t retroactively clean already‑infected machines. Players are being advised to scan for malware, and the publisher has opened a channel for financial‑loss inquiries. Whether the attackers used the backdoors to move laterally beyond the compromised launcher remains unclear. The investigation is ongoing, and the full scope of the breach—how many users were affected, and what data was actually taken—hasn’t been disclosed yet. The next milestone to watch is the November 12 update and any further details the publisher releases about the investigation.

[![Beans](https://beans.cafecito.tech/favicon.ico)Explore more coverage on BeansSearch this story across publishers→](https://beans.cafecito.tech/search?q=Domain%20hijack%20gave%20attackers%20remote%20control%20of%20NIKKE%20PC%20launcher%2C%20prompting%20password%20resets&utm%5Fsource=espresso.cafecito.tech&utm%5Fmedium=referral&utm%5Fcampaign=cafecito&utm%5Fcontent=level-infinite-nikke-launcher-malware-injection)