On November 4, 2026, the team behind Goddess of Victory: NIKKE reported a security problem involving its Windows PC launcher. The team said it had identified signs that launcher script files may have been altered by an unauthorized third party and confirmed that a client update had been released. Separately, an independent technical investigation raised concerns about malicious software that could allow remote access to some players’ computers. The number of affected users and the extent of any data theft have not been officially confirmed.
Goddess of Victory: NIKKE is a science-fiction shooting role-playing game developed by South Korean studio SHIFT UP and published globally by Level Infinite. The game is available on Windows PC, Android, and iOS. Its PC version uses a separate launcher to start the game and load supporting files.
An independent technical investigation identified four JavaScript files on Level Infinite’s content delivery network (CDN) that appeared to contain unauthorized code. A CDN is a network of servers used to deliver files to applications. The NIKKE PC launcher loads some of these files during startup, meaning altered scripts could introduce harmful instructions through software that players normally trust. The investigation has not established how the attacker originally gained access to the file distribution system.
According to the independent investigation, the suspicious launcher code could download a remote-access program onto some players’ computers. Once installed, such software can allow attackers to run commands, inspect files, capture screenshots, and access sensitive information without the user’s permission. Related threats, including infostealer malware, can also target saved passwords, browser data, and authentication information. However, the capabilities identified in the investigation do not establish that every potentially exposed computer was infected or that every type of data was stolen.
Security researchers have also warned that the suspected malware could expose saved browser passwords, login information, authentication tokens, and cryptocurrency wallet data. However, the full number of affected players remains unknown. There is also no confirmed evidence that every player who opened the launcher was infected or that large amounts of personal information were successfully stolen.
On November 4, the NIKKE team published an official PC launcher anomaly notice, confirming that client fixes and an update had been implemented at approximately 2:30 a.m. Japan and Korea time (UTC+9). The team acknowledged signs of possible third-party tampering and said it was investigating the extent of the incident. It also stated that further information about follow-up measures would be provided in a separate announcement. The notice did not confirm how many players or devices had been affected.
An independent technical report on GitHub indicates that four JavaScript files distributed through Level Infinite’s CDN contained unauthorized code dating back to September 27, 2026. The investigation also identified evidence suggesting that a remote-access component could have operated on some computers from at least October 23. However, the malicious component did not necessarily activate every time the launcher opened. These findings have not yet been established as the final official incident timeline, and the total number of affected players remains unknown.
Windows PC players who opened the NIKKE launcher during the reported risk period should take additional security precautions and follow the latest official guidance before using the launcher again. Players should update their security software and check their computers for suspicious activity. Microsoft provides instructions for running a Microsoft Defender Offline scan, which can help detect certain threats that are difficult to identify while Windows is running. If an infection is suspected, players should disconnect the affected device from the internet and seek appropriate security assistance before resuming normal use.
Players who believe their computers may have been exposed should change important passwords from a separate, trusted device and enable multi-factor authentication wherever possible. They should also sign out of active sessions and revoke suspicious sessions when their account providers support these options. This is important because stolen cookies or authentication tokens may allow session hijacking even after a password has been changed. Users with cryptocurrency wallets, financial accounts, or other sensitive information on an affected computer should follow their providers’ security and recovery instructions. Installing an updated launcher alone does not guarantee that previously installed malware has been removed.
There is currently no confirmed evidence that the same incident has affected the Android or iOS versions of Goddess of Victory: NIKKE. The reported security concern primarily involves the PC launcher and the files it downloads during startup.
The NIKKE incident highlights the risks of a possible software supply chain attack, in which attackers interfere with software components or the systems used to deliver them. Even an official game launcher can become a security risk if unauthorized code reaches users through trusted distribution channels. The situation shows why gaming companies must protect their update systems, content delivery networks, and software files while providing clear security guidance when suspicious activity is discovered.
The NIKKE team is expected to provide further information about the incident and any additional protective measures. Important unanswered questions include how the launcher files were altered, which players may have been exposed, and whether affected computers require further cleanup. Until those details are confirmed, players should follow official security announcements and remember that updating a launcher does not automatically remove malware already installed on a computer.
