Players of GODDESS OF VICTORY: NIKKE are facing a serious security threat after researchers discovered that the game’s official PC launcher had been compromised. Attackers reportedly modified files hosted on Level Infinite’s servers, allowing malicious software to reach players through the legitimate game launcher.
The incident has raised major concerns about account security, personal information and the safety of computers used to play the popular anime shooter.
Even more concerning, players did not need to download suspicious modifications or visit malicious websites. Simply opening the official launcher could have exposed their systems to the attack.
Hackers Targeted NIKKE’s Official Launcher
According to an investigation published by security researcher MotherSphere, attackers modified four JavaScript files hosted on Level Infinite’s content delivery network on September 27, 2026.
These files were automatically loaded whenever players opened the NIKKE PC launcher. By modifying them, attackers created a way to download and execute additional malicious software.
The investigation indicates that the malicious remote-access program was being distributed by October 23 at the latest, although not every launcher session resulted in an infection.
Unlike traditional malware attacks, this incident involved trusted infrastructure belonging to the game’s publisher. Players could therefore encounter the malicious code while using software they had downloaded through official channels.
The exact method attackers used to gain access to Level Infinite’s servers remains unknown.
Malware Could Give Hackers Control Over Your Computer
The malicious software reportedly operated as a remote-access agent, allowing attackers to issue commands on infected computers.
Researchers discovered functionality capable of collecting sensitive information, including passwords stored in web browsers, cryptocurrency wallet data and authentication credentials.
The malware also targeted SSH keys, cloud service credentials and files commonly used by software developers.
Additionally, attackers could potentially capture screenshots, browse personal files and download information from affected systems.
One particularly worrying capability involved Google Chrome. The investigation identified a mechanism designed to install a malicious browser component that could continue operating after the NIKKE launcher had closed.
This means that simply shutting down the game might not be enough to eliminate every possible threat.
However, the existence of these capabilities does not confirm that attackers used every function against infected players. The actual extent of stolen information remains unknown.
Steam Deck and Linux Players Are Also at Risk
Although the malicious software primarily targets Windows systems, the investigation suggests that Linux and Steam Deck users are not automatically protected.
Players running NIKKE through Proton could also have exposed sensitive information.
Proton allows Windows applications to operate on Linux-based systems, but it does not provide complete isolation from personal files.
As a result, attackers could potentially access documents, authentication keys and other sensitive information stored within accessible directories.
The Chrome-specific persistence mechanism identified by researchers primarily affects Windows installations.
How to Check Whether Your NIKKE Launcher Was Infected
Players who opened the NIKKE PC launcher during the affected period should check their systems for suspicious activity.
One of the easiest initial checks involves locating the launcher’s debug log.
Inside the NIKKE installation directory, open the following file:
Launcher/intl_service/debug.log
Search the file for the following text:
k2f_chan
According to the security investigation, finding this entry indicates that the malicious agent executed on the system.
However, the absence of this entry does not guarantee that a computer is safe. Logs may have been deleted, overwritten or removed during a reinstall.
Researchers also identified another potential indicator within the launcher’s local storage files:
k2f.agent.state
Players should avoid assuming that reinstalling the game automatically removes every trace of the infection.
What Should Players Do to Protect Their Accounts?
Anyone who suspects their computer was affected should immediately close the NIKKE launcher and consider disconnecting the device from the internet.
A full malware scan is recommended, although antivirus software may not detect every component associated with this attack.
Players should change important passwords using another trusted device, particularly those associated with email accounts, gaming platforms and financial services.
Active login sessions should also be revoked where possible, since stolen authentication information could potentially allow attackers to access accounts without entering a password.
Anyone storing cryptocurrency wallets on an affected computer should consider transferring funds to a newly created wallet with a fresh recovery phrase.
Developers who use the same computer for gaming and professional work should also review their SSH keys, API tokens and cloud service credentials.
For confirmed infections, a clean operating system installation may be the safest recovery option. Password changes alone cannot guarantee that persistent malware has been removed.
Level Infinite Confirms Launcher Security Incident
On November 4, the NIKKE operating team acknowledged signs that a third party may have tampered with a script file used by the PC launcher.
Level Infinite reportedly identified the issue during the early morning and began deploying a client fix.
The company is investigating the incident and assessing its potential impact.
Researchers previously observed that three compromised files had been replaced on November 3. Another file had already been corrected at its origin server, although altered copies reportedly remained available through certain distribution servers afterward.
This raises an important concern about whether every affected file was successfully removed from the publisher’s infrastructure.
At the time of writing, the total number of affected players remains unknown. There is also no confirmed figure for how much personal information, if any, attackers successfully extracted.
The investigation has focused on the PC launcher, and there is currently insufficient evidence to conclude that the mobile versions of NIKKE were compromised.
A Serious Warning About Trusting Official Game Launchers
This incident highlights a particularly dangerous form of cyberattack known as a supply-chain compromise.
Instead of convincing players to download suspicious software, attackers allegedly used files delivered through official infrastructure to distribute malware.
That distinction matters because players generally expect legitimate game launchers to be safe.
For Level Infinite, the incident raises serious questions about how attackers gained access to its distribution systems and why the unauthorized modifications reportedly remained present for several weeks.
The publisher must now determine whether the compromise extended beyond NIKKE and whether additional security measures are necessary to prevent similar attacks.
More importantly, affected players deserve clear communication about the potential risks to their personal information.
GamingHQ strongly recommends that PC players treat this incident seriously, especially anyone who launched NIKKE during the affected period. Until the full scope of the compromise becomes clear, checking for infection and securing important accounts should take priority over returning to the game.
We will continue monitoring developments as Level Infinite investigates the incident.
Add GamingHQ as a preferred source to stay updated on gaming news, security incidents and important developments affecting players worldwide.
