---
title: NIKKE's developers confirm the PC launcher's script files may have been tampered with by a third party and pushed a fix; community analysis says the code could drop a remote-access agent | ctxsec
url: https://ctxsec.com/items/nikke-pc-launcher-script-tampering-confirmed-level-infinite-nov-4
description: "The NIKKE team (SHIFT UP, published by Tencent's Level Infinite) said on Nov 4 it found an anomaly indicating the PC launcher's script files may have been modified by a third party, shipped a client fix and update at about 02:30 JST on Nov 4, and is still assessing the impact. A community write-up that surfaced the issue says attacker code was added to JavaScript files on Level Infinite's CDN starting Sep 27, and that from about Oct 24 opening the launcher could sometimes install a remote-access agent able to run commands, read files, take screenshots and collect browser passwords, cookies, tokens, SSH keys and wallet data. The vendor has not confirmed those details or said how many players were affected."
status: "official (GODDESS OF VICTORY: NIKKE team notice on X, Nov 4). Payload and date details are from a community write-up the vendor has not confirmed"
published: 2026-11-04
---

> The NIKKE team (SHIFT UP, published by Tencent's Level Infinite) said on Nov 4 it found an anomaly indicating the PC launcher's script files may have been modified by a third party, shipped a client fix and update at about 02:30 JST on Nov 4, and is still assessing the impact. A community write-up that surfaced the issue says attacker code was added to JavaScript files on Level Infinite's CDN starting Sep 27, and that from about Oct 24 opening the launcher could sometimes install a remote-access agent able to run commands, read files, take screenshots and collect browser passwords, cookies, tokens, SSH keys and wallet data. The vendor has not confirmed those details or said how many players were affected.

[← Cybersecurity News](/news) · [markdown](/items/nikke-pc-launcher-script-tampering-confirmed-level-infinite-nov-4.md)

official (GODDESS OF VICTORY: NIKKE team notice on X, Nov 4). Payload and date details are from a community write-up the vendor has not confirmed

2026-11-04

### NIKKE's developers confirm the PC launcher's script files may have been tampered with by a third party and pushed a fix; community analysis says the code could drop a remote-access agent

- **If you or your users ran the NIKKE PC launcher since late September:** the community write-up suggests searching `Launcher/intl_service/debug.log` for `k2f_chan` and the launcher's Local Storage for `k2f.agent.state` (unverified by the vendor).
- On a hit, treat the machine as compromised: reimage, then rotate browser-saved passwords, session cookies, SSH and API keys from a clean device, and move any crypto wallets.
- Watch for the vendor's follow-up notice on scope and remediation.

Sources: [4Gamer: NIKKE official notice on PC launcher tampering (Nov 4)](https://www.4gamer.net/games/685/G068576/20261104056/) · [AUTOMATON West: NIKKE PC launcher supply-chain attack (updated with official statement)](https://automaton-media.com/en/news/goddess-of-victory-nikke-pc-launcher-reportedly-compromised-in-supply-chain-attack-no-official-confirmation-from-developers-yet/) · [Seoul Economic Daily: NIKKE PC launcher shows signs of tampering (Nov 4)](https://en.sedaily.com/technology/2026/11/04/goddess-of-victory-nikke-pc-launcher-shows-signs-of) · [Community write-up (GitHub gist)](https://gist.github.com/MotherSphere/d6c049a09ba8ac3085c51ee9df24a4e5)