Supply Chain Attack Targets Goddess of Victory: NIKKE PC Launcher
Compromised JavaScript files in the launcher facilitate remote malware installation and credential theft.
1Launcher Compromise Confirmed
Developer SHIFT UP confirmed a supply chain attack targeting the Goddess of Victory: NIKKE PC launcher. The breach involves compromised JavaScript files delivered through standard launcher updates. This incident highlights critical vulnerabilities in the software distribution pipeline, potentially affecting other game launchers supported by publisher Level Infinite during the update process.
2Timeline of Malicious Activity
Initial evidence of compromised JavaScript files within Level Infinite systems dates back to September 27, 2026. Between October 31 and November 3, 2026, users reported unauthorized remote malware installations. The delay between the initial system compromise and the public discovery suggests a sophisticated, long-term infiltration of the software update delivery mechanism.
3Remote Execution Capabilities
The attack grants threat actors remote access to affected devices while the launcher remains active. Attackers can execute arbitrary commands and capture screenshots of the user's desktop environment. This level of control indicates that the malicious code operates with elevated permissions, bypassing standard security checks during the automated game update cycle.
4Targeted Data Exfiltration
The deployed malware functions primarily as an information stealer designed to harvest sensitive local data. Specifically, it targets cached browser credentials, SSH keys, and API keys associated with various AI development tools. By focusing on these high-value assets, the attackers aim to compromise both the user's personal accounts and professional development environments.
5Strategic Timing of Attack
The timing of this breach coincides with the game's major 4th Anniversary story event. This period attracts millions of new and returning players, significantly expanding the potential victim pool. The attackers likely leveraged this peak traffic to maximize the impact of the malicious update and ensure a high volume of successful infections.
6Broader Ecosystem Risks
There is a realistic possibility that other game launchers managed by Level Infinite share similar structural vulnerabilities. Because the malicious code was embedded directly into the update delivery system, any platform utilizing the same infrastructure remains at risk. Security teams must now audit shared libraries and update servers to prevent further lateral movement.
7Technical Attack Mechanism
The attack relies on the manipulation of .js files that execute upon launcher startup. By injecting malicious scripts into these files, the threat actors ensure that the payload runs automatically without requiring user interaction. This persistence mechanism makes the infection difficult for standard antivirus software to detect until the malicious behavior begins.
8Implications for Software Security
This incident underscores the inherent dangers of supply chain attacks in the gaming industry. When trusted update channels are compromised, users have no effective way to verify the integrity of the software they install. Developers must implement stricter code signing and integrity checks to secure their distribution pipelines against such sophisticated unauthorized modifications.
Original article: cybersecurity — Supply Chain Attack Targets Goddess of Victory: NIKKE PC Launcher