Players of the free-to-play shooter Goddess of Victory: NIKKE have been urged to check their computers after attackers tampered with files loaded by the game's Windows PC launcher. Opening the launcher could install a remote-control agent capable of running commands, reading files, taking screenshots and stealing saved passwords.

The incident is a supply-chain attack: instead of tricking players into downloading a fake game, the attackers compromised resources used by the legitimate launcher itself. Anyone who opened software they already trusted could therefore have been exposed.

Independent researcher MotherSphere, who first documented the compromise, found malicious code in four JavaScript files hosted on publisher Level Infinite's official content delivery network. The files were modified on 27 September 2026. Evidence shows the remote-control agent was running on at least one machine from 23 October at the latest, and it could be delivered on some launches only, which means many players may have opened the launcher safely while others were infected.

According to the researcher's analysis, the agent could run programs and system commands, browse folders and download files, take screenshots, retrieve saved NIKKE login credentials, collect browser passwords and cookies, search for developer credentials and API tokens, and collect cryptocurrency wallet data. On Windows, a persistent component could keep running after the launcher was closed, and later findings showed it could also load inside other programs, including Steam's web helper.

Level Infinite confirmed the problem in a statement on 4 November and replaced the tampered files. Three files were replaced on 3 November, and the fourth was cleaned across the remaining content delivery servers on 4 November. The publisher has since added a malware check to the official PC client: since 4 November at 23:00 GMT, the client scans for the malware at launch and, with the player's agreement, deletes related logs, files and registry entries.

The attacker's domain, insightjs.com, was suspended by its registrar on 5 November, and the researcher's report was still being updated on 8 November with new findings, including a ninth known upload of the agent. Level Infinite has apologised to players and says it is preparing compensation, but it has not explained how the attackers gained write access to its content delivery network.

The number of compromised computers and the full extent of any data theft remain unclear. Mobile players are not affected, according to Level Infinite, and need take no action. Anyone who opened the Windows PC launcher from late September should check their computer before opening it again, follow the publisher's removal instructions, and change passwords from a clean device. Players who believe they were affected, including anyone who has suffered losses on other accounts, are asked to contact Level Infinite's customer support team.