2026 Goddess of Victory: NIKKE PC Client Hacking Incident

1. Overview

Between the night of November 3 and the early hours of November 4, 2026, it came to light that files on Level Infinite (Tencent)’s official distribution server (CDN), which are loaded when the PC launcher for the mobile game GODDESS OF VICTORY: NIKKE starts, had been tampered with on September 27. As a result, users’ PCs may have been infected with remote-control malware. The incident was brought to attention by user communities and a technical report from an independent security researcher, and was reported by several media outlets, including Yonhap News and Inven, on November 4.

The files in question were not fake installation files or illegal programs, but files that the official launcher downloaded normally. This made the incident particularly serious: users could have been infected simply by launching the client, without doing anything unusual. However, as of the time of reporting, neither the extent of any actual data theft nor the identity of the attacker had been revealed.

2. Server Tampering and Malware Structure

According to a technical report on GitHub cited by Yonhap News and JoongAng Economy News, JavaScript files on a CDN server used by Level Infinite were tampered with by an unidentified attacker on September 27. A NamuWiki article listed three tampered files (aegis-fix.min.js, images.7fec4c32.js, and FeedList.feb647c9.js), while Inven reported that the report analyzed four files on the official server as having been injected with commands to load external malware. Sources differ on the number of files. All of these files run automatically when the NIKKE PC launcher starts. The tampered code reportedly acted as a loader, downloading additional scripts from external servers (insightjs.com, insightjs.org).

Once installed, the agent was analyzed as being closer to a remote access tool that lets an operator issue commands remotely than to a program that steals a fixed set of information. The functions listed in the NamuWiki article include running arbitrary programs, viewing and downloading files on the PC, taking screenshots of the entire monitor, collecting passwords and cookies stored in browsers, collecting developer-tool keys and tokens, and searching for 28 types of cryptocurrency wallet files. It reportedly also included a persistence mechanism that planted a malicious DLL in Chrome’s installation directory so it could continue running after the launcher was closed, as well as routines to erase traces of infection. According to Inven, Linux and Steam Deck users running the game through Proton were also exposed to the same risk.

Sources also differ on when infections could have occurred. The NamuWiki article stated that the malware could have been installed if the launcher had been run even once from September 27 onward. Yonhap News and Inven, however, said the report’s author believed infection had been possible since October 24 at the latest, and identified users who ran the launcher after October 24 as being at risk.

3. Discovery and Public Disclosure

According to the NamuWiki article, the incident came to light at around 9 p.m. on November 3. A user with an anonymous handle on the NIKKE minor gallery was trying to find out why League of Legends, which had worked until the day before, suddenly would not launch. They discovered that Vanguard was detecting a hijacked DLL and blocking the game from starting. Further investigation reportedly showed that the DLL had been installed by the NIKKE launcher, and that running the launcher with a proxy enabled revealed signs that the launcher itself had been hacked. The user reported the incident to the Korea Internet & Security Agency’s incident response team and, at the same time, published a scanner on their GitHub account to warn others.

However, the NamuWiki article noted that the original post that first brought the incident to public attention could no longer be viewed because the gallery manager had labeled the reporter a troublemaker, deleted the post, and blocked them. Inven, meanwhile, reported that the suspicions began after users on the Chinese game community NGA noticed unusual signs, and that reports also emerged on the Taiwanese gaming forum Bahamut from several Japanese-server users who had found the same traces in their logs. According to Inven, the report was published on GitHub on November 3, and domestic media reported on it the following morning.

4. Server Restoration and Company Response

The tampered files did not begin to be replaced with clean versions until the early hours of November 4. According to the report cited by Inven, three of the four tampered files were replaced between 2:04 a.m. and 2:21 a.m. Korea Standard Time on November 4. The remaining file had already been fixed on the origin server on October 28, but some regional distribution servers were still serving the tampered file as late as 7:26 a.m. on November 4. The NamuWiki article gave a different account: two tampered JS files were replaced at around 2 a.m., while the remaining file had already been addressed on October 28. The same article stated that some CDN servers were still serving the tampered version as of 4 a.m., and that the attacker cut off the server response and fled at around 3:30 a.m.

The company’s official response was limited as of the time of reporting. In response to a Yonhap News inquiry, Level Infinite said only that it was “conducting an internal investigation.” Inven reported that, as of the morning of November 4, neither the developer Shift Up nor Level Infinite had posted a statement on its official channels. Safe Times pointed out that replacing the files on the server and removing malware already downloaded to users’ PCs were separate matters. Even after restoring the distribution route, the companies would still need to check for existing infections and inform users of any necessary steps.

5. Guidance for Users

The method for checking for infection, given both by the report’s author and the NamuWiki article, is to open Launcher\intl_service\debug.log in the game’s installation directory and search for the text “k2f_chan.” If this text appears, it is considered evidence that the agent ran. A Reddit post also advised users to immediately uninstall NIKKE and change all their passwords if “k2f_chan” and the word “registered” appeared in the debug log.

However, the researcher cautioned that the absence of a record does not mean users are safe. Because the malware had routines for erasing traces, a post-incident check that finds nothing cannot establish that no data was stolen. If infection is suspected, users are advised to disconnect from the internet and delete the malicious cache folders, DLLs, and registry keys listed in the NamuWiki article. They should then change their passwords using a different, safe device, sign out of all existing sessions, move their digital assets to a new wallet, and revoke developer security keys. Users were also advised to stop launching the PC client until an official fix announcement was issued.

6. Authenticity Debate

The key questions are whether the incident should be considered to have resulted in large-scale data theft, and whether the currently known account of the breach’s entry point and scope can be accepted as accurate.

6.1. The View That the Incident Should Be Considered Serious

This side points primarily to the nature of the malware. If the installed software was a remote-control agent rather than a simple information stealer, the attacker could have done virtually anything, from running arbitrary programs and viewing files to taking screenshots and collecting stored account and wallet information. Moreover, according to the NamuWiki article, the routines for erasing traces and the lack of logs mean that victims have no way to determine what was taken, when, or how much. Since the absence of traces does not mean that users are safe, this argument holds that the worst-case scenario should be assumed.

The potential scope of exposure was also broad. Users could have been infected simply by launching the official client, and the tampering is believed to have begun on September 27. Linux and Steam Deck users were at risk, as well as Windows users, and the same traces were reportedly found in logs from Japanese-server users. A post by one user on FM Korea illustrates how seriously some users took the situation, to the point of considering whether they needed to format their entire computers. The post also claimed that Windows credentials, browser passwords, AI coding tools, and GitHub information had been stolen. The list of functions in the NamuWiki article, including the collection of Windows Credential Manager dumps, is consistent with these concerns.

6.2. The View That It Is Too Early to Draw Conclusions

The opposing view argues that “could do” is not the same as “did.” Safe Times noted that the mere fact that malware has certain capabilities does not prove that information was actually stolen, and that neither the number of affected users nor the types and volume of leaked information had been confirmed. According to Inven, the researcher did not directly run the malware itself for safety reasons, and analyzed only its code structure. In addition, the malware was not structured to extract all ordinary passwords stored in Windows; it read only information related to developer tools. This differs from claims relayed in the FM Korea post that “even Windows credentials were all stolen,” and also conflicts with the NamuWiki article’s account.

Accounts of the breach’s entry point also differ. A community post reproduced on FM Korea claimed that NIKKE itself had not been hacked, but that two domains managed by Level Infinite had expired and a hacker who discovered this had bought one of them and uploaded malware to it. This post gives the same initial distribution date of September 27 as the report, but its explanation differs from the accounts by Yonhap News and Inven that the CDN server itself was hacked. Inven also reported that it was not yet known how the attacker had obtained the authority to alter files on the official distribution server. Safe Times said further confirmation was needed as to whether the mobile app was affected and whether files distributed to users in Korea had used the same route. Inven likewise said that the suspected malware had been found only in files loaded by the PC launcher, and that the impact on mobile environments could not be confirmed.

Ultimately, the report and multiple media outlets agree that the server was tampered with and malware was inserted, but the extent of any actual data theft and the method of intrusion remain unclear pending the company’s official investigation.

7. Trivia

• A post on FM Korea relayed a post from an overseas anonymous message board that listed several Tencent-affiliated games—including NIKKE, PUBG Mobile, Delta Force, and Honor of Kings—as having been hacked, and said rumors were circulating that Tencent as a whole had been hit. However, no evidence supporting this was confirmed, and the reports about this incident identified only one PC launcher. The same FM Korea post also included a claim that Chinese users, angered by the incident, had hacked the launcher, but this too was unconfirmed.
• One user in the same post wrote that Outlanders, which does not have a PC client, was unrelated to the incident.
• On October 29, a few days before the incident became known, NIKKE released its fourth-anniversary update worldwide.