Shift Up, the developer of Goddess of Victory: NIKKE, has announced that it found irregularities indicating the script files in the game’s PC launcher may have been tampered with by a third party. The company released client fixes and an update at around 2:30 a.m. JST on November 4 and is now investigating how far the issue reaches.

The announcement follows reports from South Korean outlet INVEN and players around the world that the launcher had been hit by a supply-chain attack. When those reports first appeared, neither Shift Up nor publisher Level Infinite had made an official statement.

【Notice Regarding PC Launcher Anomaly】

We have identified an issue indicating that the PC Launcher’s script files may have been tampered with by a third party.

---

Follow us on Twitter Follow @GamerBraves and Tweet us Tweet to @GamerBraves

---

Accordingly, client fixes and an update were implemented on November 4 at approximately 02:30 (UTC+9).

We are currently investigating the scope of the impact caused by this issue, and we will provide further details regarding follow-up measures in a separate notice.

We apologize for the inconvenience caused.

GODDESS OF VICTORY: NIKKE Team

#NIKKE

— GODDESS OF VICTORY: NIKKE – 4th Anniversary (@NIKKE_en) November 4, 2026

A timeline put together by players on the Chinese forum NGA and published on GitHub says attackers began injecting malicious code into four JavaScript files hosted on Level Infinite’s official CDN on September 27. The PC launcher loads these files each time it opens. From October 24 at the latest, the code could install a remote-access agent on a player’s computer when the launcher was opened. The infection did not happen every time, and the agent was only activated on some launches.

Once installed, the agent reportedly gave the attacker wide access to the infected computer. This included running any program or system command, browsing and downloading files, and taking screenshots of every monitor. It could also reach saved browser passwords, cookies and authentication tokens, and search for sensitive information such as SSH keys, API credentials and cryptocurrency wallet data.

According to the report, anyone who opened the NIKKE PC launcher from October 24 onward, before the malicious files were fixed, may be affected. As of November 3, three of the four compromised JavaScript files had been replaced. The fourth was cleaned at its origin server on October 28, but two CDN servers were still distributing the modified version as of November 3. Shift Up has said it will share more details on follow-up measures in a separate notice. In the meantime, players who are unsure whether their devices were infected can follow the steps in the GitHub document, which also lists actions to take if an infection is found.