Independent researcher MotherSphere reports that from 27 September 2026 four official JavaScript files on Level Infinite's content delivery network, which the Goddess of Victory: NIKKE PC launcher loads, contained attacker code, and that from 23 October at the latest opening the launcher could install a remote-control agent able to run commands, read files, take screenshots and steal passwords, browser cookies, tokens, SSH keys and crypto wallets.

The researcher says how the attacker got write access to the CDN is still unknown, that all four files were clean on the CDN servers checked on 4 November at 11:20 GMT, and that launcher caches can still hold the modified files. (source: MotherSphere)

The game's developers confirmed in a statement on X that the PC launcher's script files may have been tampered with by a third party and that client fixes and an update were implemented on 4 November at about 02:30 (UTC+9), and said they are investigating the scope of the impact, according to BleepingComputer.

BleepingComputer says it examined two of the modified files and confirmed they contained an obfuscated loader that fetched and ran additional code, and that it is unknown whether attackers stole cryptocurrency from players. (source: BleepingComputer)