Goddess of Victory: NIKKE PC launcher reportedly compromised in supply-chain attack. No official confirmation from developers yet (Updated)

Update (2026/11/04 at 13:00 JST): Shift Up has announced that it has identified irregularities that indicate the script files of NIKKE’s PC launcher may have been tampered with by a third party. Accordingly, client fixes and an update were implemented on November 4 at approximately 02:30 (UTC+9). The company is currently investigating the scope of the impact caused by the issue, and will provide further details regarding follow-up measures in a separate notice.

Original article is as follows:

South Korean outlet INVEN and Goddess of Victory: NIKKE players around the world have been reporting that the game’s PC launcher appears to have been hit by a supply-chain attack, compromising its security. At the time of writing, there has been no official confirmation or statement on the matter from developer Shift Up or publisher Level Infinite. 

According to a timeline put together by players on the Chinese forum NGA (published via GitHub), starting September 27, attackers managed to inject malicious code into four JavaScript files hosted on Level Infinite’s official CDN. These files are loaded by NIKKE’s PC launcher when it opens. From October 24 at the latest, the malicious code could reportedly install a remote-access agent on a player’s computer when they opened the launcher. The infection did not necessarily occur every time the launcher was opened, and the malicious agent was only activated on some launches. 

Once installed, the agent gave the attacker extensive access to the infected computer, including the ability to execute any programs and system commands, browse and download files, take screenshots of every monitor, access saved browser passwords, cookies and authentication tokens, as well as search for sensitive information, including SSH keys, API credentials, and cryptocurrency wallet data. 

According to the report, the potentially affected group includes anyone who opened the NIKKE PC launcher from October 24 onward, before the malicious files were fixed (as of November 3, three of the four compromised JavaScript files had been replaced. The fourth file had been cleaned at its origin server on October 28, but two CDN servers were still distributing the modified version as of November 3). 

Players are advised not to open the NIKKE PC launcher until the developers officially confirm that the issue has been resolved; and to clear any cache before running it again. For those unsure if their devices have been infected, the aforementioned GitHub document provides steps on how this can be checked and certain measures that can be taken in case of infection. 

Related: Capcom reports large-scale data breach affecting approximately 11.77 million “Capcom ID” accounts. No credit card information compromised

SEGA’s major arcade network services down after subsidiary suffers server breach