The official PC client for Goddess of Victory NIKKE has reportedly been caught up in a supply chain attack that puts players at risk of remote access malware. In reports published November 4, community researchers describe malicious JavaScript injected into the content delivery network run by publisher Level Infinite, code that can trigger unauthorized execution when the game client launches. Neither developer SHIFT UP nor Level Infinite has issued an official statement about the reports so far.
NIKKE is a free to play squad based shooter with gacha recruiting, and its PC client is one of the main ways players log in outside mobile. That makes the launcher a high value target. Compromised delivery infrastructure means even careful players who download only from official sources can still receive tainted files, which is exactly why supply chain incidents cause so much concern among players of the official NIKKE release.
What the researchers found in the launcher
According to the published analysis, the attackers inserted hostile JavaScript files directly into the delivery network that serves the PC client. When a player starts the launcher, that injected code can run without any visible warning and fetch a second stage payload from a remote server. The researchers frame this as a classic supply chain compromise, where trust in an official update channel is turned into a delivery route for malware.
The timing adds context for current players. The game recently marked a major milestone with its NIKKE 4th Anniversary update, and anniversary periods usually bring returning players back to the client. More logins during an event window can widen the pool of exposed systems, so anyone who opened the PC launcher around the anniversary should treat this report with extra care. A related NIKKE anniversary livestream drew similar attention from lapsed players in the same period.
How the malware keeps control of a Windows PC
The reported payload is a remote control tool with broad spying power. While the launcher stays open, it can capture screenshots of the desktop, browse through local directories, and run arbitrary system commands sent by the operator. That combination hands an attacker a live window into everything happening on the machine, not just inside the game.
The more serious claim concerns persistence on Windows. The analysis says the malware writes registry keys that force Google Chrome processes to load a hostile background library file. Because that hook fires whenever Chrome starts, the infection can survive closing the game client entirely. From the browser the attackers can then reach for saved passwords, active session cookies, SSH keys, API tokens, and cryptocurrency wallet extensions. Readers who follow the studio may recall that SHIFT UP also has history in the genre through the SHIFT UP role playing game Destiny Child, which makes account hygiene across shared publisher logins worth reviewing as well.
Security minded players should note that this persistence route targets the browser rather than the game folder. Deleting and reinstalling NIKKE alone would not remove registry based hooks or a rogue library that Chrome keeps loading, so cleanup has to address the operating system and the browser profile too.
What NIKKE players should do right now
The researchers advise PC users to avoid opening the game client until server side security patches are confirmed by the publisher. That pause costs nothing and removes the main trigger for the injected code. Players who launched the client recently can inspect launcher log files for specific string indicators named in the analysis to check whether the compromised code executed during their sessions.
For systems that show signs of infection, the recommended remediation has four parts. First, remove the persistence keys from the Windows registry so Chrome stops loading the hostile library. Second, clear cached client data tied to the launcher. Third, run a full scan with updated security software from a trusted vendor. Fourth, reset passwords across web accounts from an uncompromised secondary device, starting with email, banking, and any account tied to publisher Level Infinite services. Password resets done on the infected machine itself could be captured, so the clean device detail matters.
Until an official fix lands, players can keep up with the game through mobile builds and official social channels instead of the PC launcher. Mobile clients were not implicated in the published analysis. Anyone managing shared or family PCs should also check every Windows user profile on the machine, since registry persistence and browser profiles are per user in many setups.
Is the NIKKE PC launcher safe to open right now
Community researchers advise keeping it closed until Level Infinite confirms a server side fix. The reported attack triggers at launch through the delivery network, so not launching removes the main risk while you wait for an official statement.
How can I tell if my PC ran the malicious code
The analysis points to launcher log files that record string indicators when the compromised code executes. Check logs from recent play sessions against the indicator strings named in the report, and treat any match as a likely infection.
What should I do if my system is infected
Remove the registry persistence keys, clear cached launcher data, scan with updated security software, and reset passwords for key accounts from a clean secondary device. Start with email and financial accounts, then game and publisher logins.
Have SHIFT UP or Level Infinite responded to the report
No official statement had been issued at the time the reports were published on November 4. Watch the official NIKKE channels and the publisher site for confirmation of a patch before reopening the PC client.
Please note that when you make a purchase through our links at GameHaunt, we might earn a small commission. This helps us keep bringing you the free journalism you love on our site! And don't worry, our editorial content remains totally unbiased. If you'd like to show some support, you can do so here.
