MalwareNIKKE
Attackers tampered with the official PC launcher for Goddess of Victory: NIKKE, so it could download malware when players opened it. This was the real, legit launcher — not a dodgy download — and once in, the malware could grab game logins, every password saved in your browser, and the cookies that keep you signed in to sites without needing a password at all. A security researcher’s investigation found it only kicked in on some launches, and BleepingComputer reports the publisher has now pushed a fix.
The move
If you play NIKKE on PC, update the launcher and run the publisher’s own check for whether you were hit — the update stops new infections but won’t clean up an old one. If you were hit, get help resetting the PC (that’s the safest fix), then on a different, clean device change your NIKKE/Level Infinite password and anywhere you’ve reused it, plus the passwords saved in your browser, sign out of all other sessions and switch on 2FA.
For teachers
Talking about this in class
This one’s useful precisely because nobody did anything wrong. Open with a student who plays a game on PC, opens the official launcher as always, and later hears it was tampered with at source — a supply-chain attack. Ask the class: if the real app can be compromised, what actually protects you?
The misconception to tackle is “I only get malware if I download something dodgy.” Push past it: a good answer recognises that you can’t always spot a compromise, so the protection is damage-limitation — unique passwords so one stolen login doesn’t open everything, 2FA so a password alone isn’t enough, and keeping software updated so fixes land fast. That’s the habit to land: assume any one account could leak, and make sure that leak stays contained. One for Computing: stolen sign-in cookies can get round a new password and 2FA until you sign out of your other sessions, which is why that step matters.
If a student says their account or details were caught up in something like this, reassure them first — it isn’t their fault and they’re not in trouble. Then: get the infected device reset, and from a clean device change the game password, any reused copies and browser-saved passwords, sign out of other sessions and turn on 2FA, tell the bank if money or card details were involved, and follow your school’s usual route for passing on a concern.