The PC launcher for Goddess of Victory: NIKKE has reportedly been compromised in a supply-chain attack that could allow attackers to access players’ computers, steal sensitive information and execute remote commands. An independent technical investigation published on November 3, 2026, identified malicious JavaScript in files distributed through publisher Level Infinite’s official content delivery network (CDN). Players who opened the launcher from October 23 onward may have been exposed, although infection was not guaranteed.
The findings come from a public investigation by GitHub researcher MotherSphere, who examined files recovered from an affected computer, launcher logs, cached JavaScript and malware samples. The researcher also incorporated additional findings submitted by other affected users. Developer Shift Up and publisher Level Infinite had not publicly confirmed the incident or announced a complete resolution at the time of reporting.
The investigation traces the suspected compromise to September 27, 2026, when four JavaScript files hosted on Level Infinite’s CDN were reportedly modified to include attacker-controlled code. Because the NIKKE launcher loads these files during startup, malicious instructions could execute through an otherwise legitimate game launcher.
According to the researcher’s updated timeline, the earliest reported execution of the remote-access malware occurred on October 23. The malicious code did not necessarily install the payload on every launch, meaning exposure and successful infection are separate possibilities.
Once delivered, the remote-access agent could reportedly execute system commands, access and download local files, capture screenshots and collect sensitive information. Analysis of the malware identified functionality targeting saved browser passwords, authentication data, SSH keys, developer credentials and cryptocurrency wallet information.
The investigation also describes a persistence mechanism affecting Google Chrome on Windows. This could allow malicious components to remain active beyond the initial NIKKE launcher session, potentially extending the risk even after players close the game.
These capabilities were identified through static analysis of the recovered payload rather than live execution by the researcher. The investigation does not establish how many players were infected or whether every available data-collection function was used against victims.
The potential exposure is not necessarily limited to Windows gaming PCs. The researcher warned that Linux users, including Steam Deck owners running the Windows launcher through Proton or other compatibility software, could also encounter the compromised launcher files. The Windows-specific Chrome persistence mechanism does not establish equivalent persistence on Linux, but the initial malicious delivery remains a concern.
On November 3, the investigation recorded changes suggesting that Level Infinite’s CDN files were being cleaned. Three affected JavaScript files were replaced at approximately 17:04, 17:13 and 17:21 GMT. A fourth file had reportedly been cleaned at its origin server on October 28, but two CDN servers were still distributing an older modified version as late as 22:26 GMT on November 3.
The researcher also observed that the attacker’s server had stopped responding by 18:31 GMT on November 3. However, neither the replacement of files nor the apparent shutdown of the malicious server establishes that previously infected computers are safe. Cached launcher files and malware already installed on affected systems remain separate concerns.
The exact method attackers allegedly used to modify Level Infinite’s CDN assets remains unknown. There is also no independently established total for affected players.
For now, the researcher recommends that PC players avoid opening the NIKKE launcher until Level Infinite confirms that the issue has been resolved. Anyone who launched the game during the potentially affected period should consider checking their system for signs of compromise.
The technical investigation documents indicators of compromise, including suspicious launcher-cache entries, malware files, network activity and unexpected Chrome components. The researcher has also published a separate read-only detection utility for Windows, Linux and Steam Deck systems. A scan finding no traces does not guarantee that a computer was never compromised.
Players who discover evidence of infection should disconnect the affected computer from the internet, preserve relevant logs and seek appropriate malware-removal assistance. Passwords and other potentially exposed credentials should be changed using a separate, trusted device, with active account sessions revoked where possible. Simply reinstalling NIKKE or deleting its launcher cache may not remove malware that has already established persistence.
The reported incident raises particular concerns because the suspected entry point was the game’s official launcher infrastructure rather than a third-party download or unofficial modification. Until Shift Up or Level Infinite provides a formal security update, the full scope of the alleged compromise and the status of remediation remain unresolved.
