Goddess of Victory: NIKKE PC launcher hit by supply-chain attack

Reports indicate that the PC launcher for Goddess of Victory: NIKKE was compromised in a supply-chain attack, potentially exposing players to malicious code. According to a timeline compiled by community members on the Chinese forum NGA and published via GitHub, attackers injected malware into four JavaScript files hosted on Level Infinite’s official CDN starting September 27. These files are loaded when the launcher opens.

The malicious code reportedly began installing a remote-access agent on user computers from October 24 onward. This agent granted extensive system access, including the ability to execute commands, browse files, take screenshots, and steal credentials such as SSH keys and cryptocurrency wallet data. The infection did not occur on every launch, affecting only some users.

As of November 3, three of the four compromised files had been replaced, though two CDN servers still distributed modified versions. No official confirmation has been issued by developer Shift Up or publisher Level Infinite. Players are advised to avoid launching the game until the issue is resolved and to clear their cache.