Goddess of Victory: NIKKE PC launcher compromised by malware

The PC launcher for Goddess of Victory: NIKKE was infected with malicious code via a supply-chain attack, reports say. Bad actors altered scripts hosted on the publisher network, which the application downloads during startup to install a remote access agent on user computers.

Goddess of Victory: Nikke · official art via IGDB

A technical breakdown states the modified files date back to September 27. The malware was running by November 1 at the latest, though some reports say it may have been active as early as October 24. While Level Infinite replaced the files on November 3, some CDN servers reportedly continued to serve infected copies for a period.

The malware can run commands, read files, and take screenshots. It steals passwords from browsers, data from Windows Credential Manager, SSH keys, and tokens for cloud and AI services. It also targets data from 28 browser-based crypto wallets. The threat affects Windows users and Linux or Steam Deck users running the game through Proton. On Windows using Chrome, the agent can establish persistence and continue running after the launcher closes.

Players can check for infection by searching the Launcher/intl_service/debug.log file in the game folder for the string k2f_chan. Neither Shift Up nor Level Infinite has publicly commented on the situation. No problems have been reported with the mobile versions of the game, though there is no direct confirmation of their safety.