Short answer
Level Infinite said on 4 November 2026 that the NIKKE PC launcher's script files may have been tampered with by a third party. A researcher reports that modified files on the official CDN, in place since 27 September, installed a remote-access agent on some players' PCs.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Level Infinite and Shift Up (Goddess of Victory: NIKKE) |
|---|---|
| Incident type | Supply-chain compromise |
| Status | Confirmed by the organization |
| Sector | Video games |
| Country | Global |
| Detected | 2026-11-01 |
| Disclosed | 2026-11-04 |
| People or records affected | Players who ran the NIKKE PC launcher during the affected period. The publisher reports over 45 million downloads of the game overall, but no count of infected PCs exists |
What data was exposed
- NIKKE account credentials, saved passwords and browser data, according to researcher analysis
- Files and screenshots from infected PCs, which the remote-access agent could collect
- Crypto wallet extension data, including recovery phrases and private keys, if a second-stage DLL was deployed (not confirmed)
What happened
Level Infinite, the publisher of the game Goddess of Victory: NIKKE, said on 4 November 2026 that it had identified an issue indicating the PC launcher’s script files “may have been tampered with by a third party.” It released a client update at 02:30 Japan time that day and said it is still investigating the scope.
What researchers report
According to a researcher known as MotherSphere, quoted by BleepingComputer, four JavaScript files on the official content delivery network were changed on 27 September 2026. The injected code was hidden inside legitimate scripts and pulled more code from two attacker domains. It then ran a payload that installed a remote-access agent called K2F. Inven Global, citing player and researcher analysis, reports the agent could run commands, browse and download files, take screenshots and steal saved passwords. The attacker’s access to the CDN is unexplained.
BleepingComputer also reports a second-stage Windows DLL that could keep running after the launcher closed and contained code to take crypto wallet data from browser extensions such as MetaMask, Phantom and Coinbase Wallet. Whether it was deployed on infected PCs is unknown. A 6 November update says several players found the Chrome-targeting DLL on their machines.
Timeline
The researcher says three files were replaced with clean versions on 3 November, and that a tampered copy of the fourth was still being served that evening. Inven Global’s account differs in small details, such as one file being cleaned at the source earlier. Both outlets agree on the 27 September start. Neither Shift Up nor Level Infinite had given a technical account of the cause at the time of reporting.
Who is at risk
Anyone who started the PC launcher between late September and early November is a candidate, though Inven Global notes the agent did not download on every launch. People who play only on phones are not covered by these reports.
What to do
The steps are listed above. The key points are to stop using the launcher, check the debug log, and change credentials from a clean computer. Because the code reached for saved passwords and wallets, start with email, banking and exchange logins. Follow our data breach checklist, and be wary of “fix” downloads, a pattern described in our guide to crypto wallet drainer scams. Fake support pages also feature in tech support scams.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Crypto theft and account takeover using passwords or wallet phrases taken from an infected PC.
- Fake 'NIKKE launcher fix' downloads that carry a second round of malware.
- Phishing that uses stolen game or email accounts to message your contacts.
What to do if you are affected
- 01Do not open the NIKKE PC launcher until the publisher confirms the problem is fixed.
- 02Check Launcher/intl_service/debug.log in the install folder for the text 'k2f_chan registered', and back up that file and the tbs_cache folder before reopening the launcher.
- 03Run a full scan with up-to-date antivirus software. BleepingComputer advises reinstalling Windows if the PC is compromised.
- 04From a clean device, change passwords, sign out of all sessions and revoke API tokens and SSH keys.
- 05If you keep crypto wallets in browser extensions, move funds to a new wallet created on a clean device.
Frequently asked questions
How do I know if my PC was infected?
Open Launcher/intl_service/debug.log in your NIKKE folder and look for 'k2f_chan registered'. BleepingComputer says that line shows the malicious agent ran, though it does not prove the second-stage DLL loaded. Back up the log before reopening the launcher, because the updated launcher can erase evidence.
Did Level Infinite confirm the attack?
It confirmed an issue indicating the PC launcher's script files may have been tampered with by a third party, issued a client update, and said it is still investigating. It promised a separate notice on follow-up measures.
Is the mobile version affected?
The reports concern the PC launcher only. Inven Global adds that Linux and Steam Deck users running the launcher through Proton were also said to be exposed.
Was crypto actually stolen?
Unknown. BleepingComputer says it is not known whether the wallet-stealing DLL was deployed on infected systems or whether any cryptocurrency was taken.
Sources
- NIKKE PC game launcher hacked to spread remote access, data-stealing malware, BleepingComputer, 2026-11-04
- NIKKE PC launcher reportedly hit by supply-chain attack, no statement yet from Level Infinite, Inven Global, 2026-11-04
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.