Players of Goddess of Victory: Nikke
face security checks and password resets after attackers compromised the game’s Windows PC launcher to distribute a remote-access trojan. Level Infinite, a publishing brand under Tencent, confirmed that script files on its content delivery network were tampered with by a third party, exposing player PCs and account data to potential theft.
Attackers Hijack Game Launcher Files
Four official content delivery network script files were altered to load scripts from an external source on September 27, 2026, at approximately 3:41 p.m. The supply-chain attack began when an external attacker hijacked a domain used for game services at approximately 10:59 a.m. that day, according to an incident timeline released by the operator Level Infinite.
【Notice Regarding PC Launcher Anomaly】 We have identified an issue indicating that the PC Launcher's script files may have been tampered with by a third party. Accordingly, client fixes and an update were implemented on November 4 at approximately 02:30 (UTC+9). We are… pic.twitter.com/0lqtlWKtcR
Malware distribution through those tampered files officially started on October 30 at 3:52 a.m.
Independent security analysis identified that executing the officially distributed PC launcher caused a remote-access agent to download onto affected computers. The malicious software supported commands to browse folders, execute system commands, capture screenshots, and harvest saved login credentials, browser passwords, cookies, developer tokens, API keys, and cryptocurrency wallet data. Mobile-only players remain unaffected by the breach, as the vulnerability is restricted to the PC launcher.
The origins of this security incident trace back to late September. The script planted by the attacker was designed to covertly download a remote access trojan from an external server the moment the launcher starts. This mechanism executes arbitrary commands with the user’s privileges.
Publisher Patches Compromised Launcher
Level Infinite detected the file anomalies on November 4, 2026. The publisher implemented client fixes and an update at approximately 02:30 (UTC+9) on that day. Level Infinite issued a formal statement addressing the community.
It should never happen that an official program launched to enjoy a game ends up threatening user safety. As the operator, we feel a profound sense of responsibility for failing to provide a service that Commanders [users] should have been able to use without a single ounce of doubt.
Level Infinite, Publishing Brand under Tencent
Level Infinite added a feature to the official PC client to scan and remove malicious programs distributed due to the compromised client. Tencent also confirmed that no other titles in its portfolio show signs of impact due to structural differences in their launcher architectures. Level Infinite formally reported the security incident to the Korea Internet & Security Agency.
Players Scan Systems and Reset Passwords
Publishers are advising anyone who booted up the PC launcher at least once after September 27 at 3:41 p.m. (UTC+9) to run the automated client scan or execute a manual security check. Affected players are instructed to change account passwords, invalidate existing API keys and access tokens, and discard them in favor of new ones. Level Infinite opened its customer support center to review reports concerning external service accounts and financial losses, promising in-game compensation as an apology.
To prevent future breaches, the operator plans to build a new integrity verification system for external resources. The company will strengthen delivery network monitoring and overhaul permission structures so that launcher functions operate using only minimum required privileges.