Shift Up, the developer of Goddess of Victory: NIKKE, has confirmed that it discovered irregularities suggesting that script files used by the game’s PC launcher may have been tampered with by a third party.
The company released client fixes and an update at approximately 2:30 a.m. JST on November 4. Shift Up is currently investigating the scope of the incident and says it will provide further information about its response in a separate announcement.
The confirmation follows reports from South Korean outlet INVEN and players worldwide alleging that the launcher had been affected by a supply-chain attack. When the reports first emerged, neither Shift Up nor publisher Level Infinite had issued an official statement.
Malicious Scripts Reportedly Distributed Through Official CDN
A timeline compiled by players on the Chinese forum NGA and published on GitHub alleges that attackers began injecting malicious code into four JavaScript files hosted on Level Infinite’s official content delivery network on September 27.
The PC launcher reportedly loads these files whenever it starts. According to the timeline, the modified code could install a remote-access agent on a player’s computer from October 24 at the latest. The infection was not triggered every time the launcher opened, and the agent was reportedly activated only during certain launches.
If installed, the agent could allegedly give attackers extensive access to an affected system. Reported capabilities included executing programs and system commands, browsing and downloading files, and capturing screenshots across connected monitors. The code could also access saved browser passwords, cookies, and authentication tokens, while searching for sensitive data such as SSH keys, API credentials, and cryptocurrency wallet information.
Players Urged to Check for Possible Infection
The report warns that players who opened the NIKKE PC launcher from October 24 onward, before the malicious files were corrected, may have been affected.
As of November 3, three of the four compromised JavaScript files had reportedly been replaced. The fourth file was cleaned on its origin server on October 28, but two CDN servers were still distributing the modified version as of November 3.
Shift Up has not yet disclosed the full extent of the incident. Players concerned about their devices can consult the investigation document published on GitHub, which includes steps for checking potential infection and recommended actions if malicious activity is detected.
The situation remains under investigation, and players should await further official updates from Shift Up regarding additional security measures.
Leave a Reply