Nikke PC launcher files tampered to spread malware, Level Infinite says

Level Infinite confirmed that the official PC launcher files for Goddess of Victory: Nikke were tampered with by a third party and used to distribute malicious programs, according to a notice the company published on its official community on November 5 titled "PC Launcher Security Incident and Follow-up Measures Guide".

The tampered launcher downloaded files containing abnormal code that connected to an external domain, and distribution through the altered scripts began on October 30 at 3:52 a.m. Level Infinite detected the anomaly around midnight on November 4 and began responding. Between 2:04 a.m. and 2:23 a.m. that day it replaced three abnormal script files to block further distribution, and at 12:09 p.m. it completed a CDN cache refresh for the remaining file.

The company said the PC launcher security measures and fixes are now complete and that the currently distributed launcher can be used normally after additional checks. It added that the actual number of infections and the scale of damage are still under investigation.

What users should do

Level Infinite recommended that anyone who ran the PC launcher at least once after 3:41 p.m. on September 27 check their security. From 8 a.m. on November 5, the official PC client included automatic malware detection and removal: users are advised to close all running web browsers and then launch the PC client, and if malware is found a prompt asks whether to remove the related files and records. A manual check method was also published, covering traces of malware execution, deletion of related files and registry entries, and antivirus scanning.

The company advised users to change passwords from a different device or a PC that has completed the security check, and to revoke and reissue API keys or access tokens stored on the affected PC. It said the incident affected only the PC launcher, while the mobile version was not affected and needs no separate security check. Users who experienced issues with external service accounts or financial damage are asked to contact the official customer center.

In-game compensation is being prepared as an apology. To prevent recurrence, Level Infinite said it plans to strengthen launcher security monitoring, build a system to verify whether externally loaded files have been tampered with, and review launcher permissions so it uses only the minimum needed to operate. The incident follows the hijacking of the insightjs.com domain, used for some game services, by a third party on September 27, the same day four script files from the official CDN downloaded by the PC launcher were tampered with.