Goddess of Victory: NIKKE PC Launcher Compromised in Targeted Supply Chain Attack
Malicious code in NIKKE launcher exposes player PCs to credential theft and remote access.
1Launcher Security Breach Confirmed
Shift Up and publisher Level Infinite confirmed a security incident affecting the Goddess of Victory: NIKKE Windows PC launcher. Unauthorized third parties tampered with launcher files, potentially allowing malicious programs to execute upon startup. This breach has raised significant concerns regarding the safety of player accounts and personal device integrity.
2Timeline of Malicious Activity
Compromised JavaScript files were identified within Level Infinite systems as early as September 27, 2026. These malicious updates were subsequently delivered to end users through the game launcher. Between October 31 and November 3, 2026, users reported instances of malware being remotely installed on their personal computers during active sessions.
3Credential Stealing Capabilities
The injected malware functions primarily as an information stealer targeting sensitive data. It specifically harvests cached browser credentials, SSH keys, and various AI tool API keys from infected machines. Beyond data theft, the compromise grants threat actors remote access, enabling them to execute arbitrary commands or capture screenshots while the launcher runs.
4Strategic Timing of Attack
The timing of this supply chain attack appears highly calculated, coinciding with the game's major 4th Anniversary story event. This period typically attracts millions of new and returning players, maximizing the potential reach of the malicious payload. The scale of the event likely served as a catalyst for the threat actor.
5Immediate Remediation Steps
Level Infinite has deployed a new feature within the official PC client to scan for and remove malicious programs. Players who accessed the game after September 27 at 15:41 UTC+9 are urged to run this tool immediately. Manual security checks are also recommended to ensure no residual threats remain on the system.
6Account Security Recommendations
Beyond cleaning the PC, affected users must prioritize account recovery and protection. Players are advised to change passwords for all accounts accessed on the compromised machine. Furthermore, generating new API keys and access tokens is essential to mitigate the risk of ongoing unauthorized access to external services and personal digital assets.
7Broader Infrastructure Vulnerabilities
The incident has prompted a thorough review of Level Infinite's entire network security environment, including their Content Delivery Network. There is a realistic possibility that other game launchers supported by the publisher share similar vulnerabilities. This potential for wider exposure necessitates a comprehensive audit of all software distribution channels currently in use.
8Future Security Commitments
To prevent recurrence, the developers plan to implement an integrity verification system for all external resources accessed by the launcher. Future updates will focus on early detection of unauthorized file modifications and ensuring the launcher requires only minimum necessary permissions. Enhanced monitoring will be established to address future security threats promptly.