The team behind *Goddess of Victory: NIKKE* has acknowledged a possible security problem with the game's PC launcher. According to 4Gamer, Shift Up and Level Infinite said on November 4 that the launcher's script files may have been altered by a third party, and that a client fix and update went out at around 2:30 AM that day.
That changes the story from an unanswered report into an acknowledged incident, though only partly. The statement confirms an anomaly. As reported, it doesn't confirm malware on anyone's PC, stolen data or the number of players involved.
The companies' notices appeared on social media and the game's official lounge, and we couldn't check those originals directly. What follows is attributed to 4Gamer, Inven Global and Automaton, which carry or summarize them.
What the companies have said
Inven Global quotes the team as saying, "We have confirmed an anomaly where script files in the PC launcher may have been modified by a third party." 4Gamer and Inven Global both report that the team is still determining the scope of the impact and will announce its response separately. Automaton carries the same account from Shift Up, timing the fix at about 02:30 UTC+9.
Shift Up CEO Kim Hyung-tae also apologized on his X account, Inven Global reports. In the outlet's translation, Kim said the company is working with Level Infinite and "mobilizing all our resources to find a fundamental solution," and added, "We are truly sorry for causing great distress and harm to all of our Commanders." Inven Global's article was translated from Korean with AI assistance and edited by its staff, so the wording may not match his original exactly.
What is still only claimed
The far more alarming details come from outside the companies. Inven Global says an independent security researcher's GitHub report, following user reports, alleges that commands designed to fetch malware were embedded in four files on Level Infinite's content delivery network on September 27.
According to Inven Global, the report raises concern that running the launcher from as early as October 24 may have installed remote-control malware. Automaton, citing a timeline assembled by players, says "from October 24 at the latest," and adds that the agent was activated only on some launches. So the start date isn't settled.
Both outlets describe a wide reach for that alleged malware. Inven Global lists browser-saved passwords, *NIKKE* account details, 28 types of cryptocurrency wallet, SSH keys and cloud credentials as targets, while Automaton adds file access and screenshots of every monitor. Inven Global also says Linux and Steam Deck setups using Proton were analyzed as exposed to the same risk. None of the coverage we read shows that the companies have confirmed any of these details.
What PC players should do now
Automaton's advice, which still stands in its updated article, is not to open the launcher until the developers confirm the issue is resolved, and to clear any cache before running it again. The reported statements say a fix has shipped, but they don't say the launcher is safe or that the work is finished. Waiting costs little until the companies say more.
Automaton also points players unsure about their PCs to the GitHub document, which it says includes steps for checking a machine and responding to an infection. That guidance doesn't come from the publisher. Automaton credits a player timeline published via GitHub, Inven Global credits a security researcher's GitHub report, and neither says outright whether they're the same document.
No date has been given for the next step. The companies have promised a follow-up notice, and the questions it needs to answer are plain: which players and regions were exposed, what was accessed, and when the launcher is safe to use.
Mason's take: A statement was the first thing players needed, and they got one on November 4, the same day Automaton's report ran. But "may have been modified" and an update don't tell a worried player what to do with their passwords. The apology from Kim is notably strong for a company still measuring the impact, which makes the follow-up notice matter even more. I'd read this as the start of the disclosure, not the end of it.
Reporting notes
