If you have opened the Windows launcher for Goddess of Victory: Nikke since late September, treat that PC as possibly exposed. Shift Up, the studio behind the game, says it spotted irregularities suggesting an outside party changed scripts the launcher runs, and a researcher’s analysis says the changed code could plant a remote-control tool on a player’s machine.
Level Infinite, which publishes the game, apologised on X on 4 November. Its notices ask anyone who ran the PC launcher at least once after 27 September to do a manual security check, and to contact customer support if they suffered damage. The game’s phone versions were not part of the analysis.
The analysis comes from a researcher who goes by MotherSphere and published it on GitHub. It says four JavaScript files on Level Infinite’s content network carried attacker code from 27 September, and that the launcher loads those files every time it starts. By 23 October at the latest, merely opening the launcher could drop an agent onto the PC. While the launcher stayed open, the attacker could issue commands, pull files and capture the screen. Players on a Chinese forum, NGA, raised the alarm first.
INVEN Global went through the analysis and lists what the code hunts for: saved browser passwords, Nikke login data, 28 kinds of crypto wallet, SSH keys and cloud credentials. On Windows it could also register itself in Chrome so it kept running after the launcher closed. Players on Linux and the Steam Deck who run the game through Proton face the same risk. Reports add that the agent did not install on every launch.
The clean-up has been uneven. Three of the four files were replaced on 4 November between 2:04 and 2:21 am Korean time. The fourth had been cleaned at its source on 28 October, but two regional servers were still handing out the altered copy that morning. How the attackers got permission to change files on the official servers is still unknown, and Shift Up says it is investigating how far the problem reached.
One catch is that the fix can remove the proof. The updated launcher, live from 8:00 am Korean time on 5 November, looks for the malware at start-up and, if you allow it, clears out the logs, DLL files and registry keys tied to it. Those are the same traces that would show whether the agent ever ran, according to the researcher. So before launching the game again, run his NIKKE Launcher Check tool and keep its report, or back up the launcher’s debug log, log folder and cache folder. INVEN says a log containing the string k2f_chan points to an infection, but a log without it is no guarantee of safety.
If you think you were hit, the researcher advises changing passwords for important accounts from a clean device such as a phone, signing out of every active session, moving any crypto to a freshly made wallet and revoking developer keys. Whether the phone versions are affected has not been confirmed.
