Supply‑Chain Compromise of NIKKE PC Launcher Exposes Player Passwords and Personal Files
What Happened — Attackers infiltrated the content‑delivery network (CDN) used by Level Infinite’s Windows launcher for Goddess of Victory: NIKKE. Malicious JavaScript was injected into four launcher files, turning the trusted client into a remote‑control agent. When a player opened the compromised launcher (Oct 23 – Nov 4, 2026) the agent could execute system commands, browse folders, capture screenshots, harvest saved game credentials, browser passwords, cookies, API tokens, and cryptocurrency‑wallet data. Level Infinite replaced the tainted scripts on Nov 4 and refreshed the CDN cache, but any PC that ran the launcher during the window may still retain the payload or have had data exfiltrated.
Why It Matters for Trust & Control Assurance — The incident highlights the need for continuous third‑party component monitoring to prove supply‑chain integrity.
Who Is Affected – Gaming publishers, PC gamers, and any organization that distributes software via third‑party CDNs.
Recommended Actions –
- Verify the launcher’s hash against the vendor’s official checksum; reinstall from a clean source if mismatched.
- Change all game‑related passwords and any reused credentials from an uncompromised device.
- Scan the system with reputable anti‑malware tools and follow Level Infinite’s removal guide.
- Implement a supply‑chain validation program (code signing, hash verification, CDN integrity checks) and retain evidence for audit readiness.
Technical Notes – Attack vector: third‑party CDN compromise (supply‑chain). No CVE was disclosed. Malicious code enabled remote‑control commands, credential harvesting, and file exfiltration. Source: Malwarebytes Labs