The PC launcher for Goddess of Victory: NIKKE was reportedly used to plant a remote-access tool on players' computers, according to analysis by players and an independent researcher. Neither developer SHIFT UP nor publisher Level Infinite had commented publicly on the reports at the time of writing.
Players on the Chinese forum NGA first pieced the claims together, and a detailed technical write-up published on GitHub on November 3rd has since laid out a timeline. According to the write-up, attacker code was added on September 27th to three official JavaScript files on Level Infinite's content delivery network (CDN), which the NIKKE PC launcher loads when it opens. From November 1st at the latest, opening the launcher could download and run a remote-control agent, though only on some launches. The author said the payload was studied without ever being run.
The write-up said the agent let its operator run any command, browse and download files and take screenshots while the launcher was open. It could also pull saved browser passwords, Windows credentials, SSH keys, developer and cloud API tokens, and data from 28 browser cryptocurrency wallets. On Windows, it reportedly set itself up inside Chrome so it kept running after the launcher closed, and the author warned that Linux and Steam Deck players running the launcher through Proton are exposed too.
Files reportedly replaced, but questions remain
According to the write-up, Level Infinite quietly replaced two of the modified files on November 3rd at 17:04 and 17:21 GMT. A third file had been cleaned at the source on October 28th, but two CDN servers were still serving the modified copy at 18:59 GMT. The attacker's server stopped responding at 18:31 GMT, the author said, and how the attacker got write access to the CDN is still unknown.
Players have been told to open the launcher's debug.log file (in Launcher/intl_service inside the NIKKE install folder) and search for 'k2f_chan', which the write-up said shows the agent ran. Its advice is to stay away from the PC launcher until Level Infinite confirms a fix and to clear the launcher's cache before using it again. Anyone infected is told to change passwords from a clean device, log out of every session, revoke API tokens and SSH keys and move crypto funds to a new wallet. A user on Taiwanese forum Bahamut, sharing the NGA analysis, said several friends who play the Japanese version had found the same string in their logs.
Where NIKKE stands
Goddess of Victory: NIKKE is a sci-fi shooter role-playing game (RPG) developed by SHIFT UP and published by Level Infinite on PC, iOS and Android. The reports concern the PC launcher only. The claims land days after the game's 4th Anniversary update went live worldwide on October 29th, while Level Infinite is still running anniversary events in major cities around the world.
