NIKKE PC game launcher hacked to spread remote access, data-stealing malware
A game launcher for a free-to-play gacha title turned out to be the cleanest path to someone's crypto wallet and passwords. That's the detail that sticks with me. Supply-chain attacks keep getting aimed at softer targets than the big software vendors everybody monitors, and launchers are exactly that: trusted, always-on, and rarely scrutinized the way an OS package manager might be.
This matters because launchers have quietly become mini operating systems, handling updates, authentication, and payment flows for millions of players. The NIKKE audience overlaps heavily with people holding cryptocurrency, and the attackers clearly knew it. We've seen this pattern with browser extensions and npm packages, where attackers ride the trust users place in a familiar distribution channel. A game launcher is the same idea, just with a much larger and more financially exposed user base.
I'd want to know how long the tampered scripts were live and whether the developers verified their build pipeline or just their distribution servers. The response matters more than the breach itself. If they locked down code signing and integrity checks, that's real progress. If they simply told players to re-download, that's not much of a fix. Either way, players should treat the official client with a measure of suspicion until the dust settles and the company proves its pipeline is clean.