Shift Up has acknowledged irregularities indicating the Goddess of Victory Nikke PC launcher scripts may have been tampered with by a third party. Here is what is confirmed, what remains alleged, and how PC users should reduce risk.
Image: IGDB
Store links: Stellar Blade x Goddess of Victory: Nikke on Steam
Shift Up has acknowledged launcher script irregularities
The strongest confirmed development is that Shift Up has publicly acknowledged irregularities indicating that Goddess of Victory: Nikke’s PC launcher script files may have been tampered with by a third party. According to Automaton West’s update citing Shift Up’s announcement, client fixes and an update were implemented on November 4 at approximately 02:30 UTC+9, while the company continued investigating the scope of the impact and said follow-up measures would be shared separately.
That confirmation matters because the core allegation is not a normal malware scare built around a suspicious download from a fake site. Reports from Inven Global, Automaton West, and BigGo Finance describe a suspected supply-chain-style incident in which files loaded by the official Nikke PC launcher from Level Infinite’s official content delivery infrastructure were allegedly modified. If accurate, the risk would have applied to players doing the normal thing: opening the Goddess of Victory Nikke launcher on PC.
There is still a clear line between what is confirmed and what is reported. Confirmed, per Shift Up as cited by Automaton West, is that launcher script files may have been altered by a third party and that a client fix was deployed early on November 4. Reported by Inven Global and attributed to a technical report from GitHub user MotherSphere are the deeper claims: four official JavaScript files were tampered with, the launcher could fetch and execute an external payload, and some affected machines may have run a remote-control agent. Shift Up’s investigation into impact was still ongoing in the cited update, so player damage, exposure numbers, and final remediation instructions were not yet settled in the provided sources.
The reported attack path ran through the launcher, not player behavior
Inven Global’s reporting, based on player reports and MotherSphere’s technical analysis, says the launcher downloads and executes several JavaScript files when opened. Inven identifies the four modified files as aegis-fix.min.js, vue-bucket.min.js, images.7fec4c32.js, and FeedList.feb647c9.js. According to that report, the files were modified on Level Infinite’s official CDN within roughly a minute between 6:41 and 6:42 GMT on September 27.
The reported method is direct and ugly: small commands were inserted into otherwise normal launcher files so that, when the launcher executed them, they would load a script from an external attacker-controlled address. Inven says the address was obscured as an array of numbers instead of plain text and was designed to retry using a different domain extension if blocked. The report also notes that added code in FeedList.feb647c9.js was placed before the closing syntax rather than at the very end of the file, a placement that could evade simpler checks that only compare file endings.
Automaton West describes the same broader concern as a supply-chain attack, meaning the player did not need to install a shady mod, click a phishing link, or sideload an unofficial build. The alleged weakness was in the path between the official Goddess of Victory Nikke PC launcher and the scripts it trusted. For a live-service PC launcher, that is the equivalent of losing control of the spawn door: every normal session starts by passing through it.
The timeline leaves a dangerous gap for PC users
The timeline reported by Inven and BigGo Finance creates the main practical concern. The files were allegedly modified on September 27. Inven says the researcher’s report found that, by October 24 at the latest, an attacker’s remote-control tool could be installed and executed during launcher startup. Automaton West also reports that anyone who opened the Nikke PC launcher from October 24 onward, before the malicious files were fixed, belonged to the potentially affected group described by the technical report.
The fix timeline is also uneven. Inven reports that three of the four compromised files were replaced with clean files between 2:04 AM and 2:21 AM KST on November 4. The remaining file had reportedly been cleaned on the origin server earlier, on October 28, but two regional CDN distribution servers were still serving the altered version as late as 7:26 AM KST on November 4. BigGo Finance reports the same broad claim: three files were replaced early on November 4, while one continued to be distributed from some servers after being restored at origin, according to the researcher.
That CDN detail is important for players because a fix at the origin server does not always mean every edge server worldwide is clean at the same moment. CDN propagation, regional caching, and launcher cache behavior can all affect what a user actually receives. The provided sources do not give a verified list of affected regions or a player-facing confirmation that every cached copy is gone. Shift Up’s stated update at approximately 02:30 UTC+9 is the official anchor, but the scope investigation is the unresolved part.
The reported payload targeted accounts, files, wallets, and developer credentials
According to Inven Global’s summary of MotherSphere’s report, the malicious payload was not analyzed by directly running the main malware for safety reasons, but the code structure indicated remote-control malware. Inven says that while the launcher remained open, the malware could allow attackers to remotely issue commands, search for and exfiltrate files, and capture screenshots without authorization. BigGo Finance describes the suspected payload as a remote access agent, or RAT, based on the same researcher’s claims.
The reported target list is broad. Inven says the malware was structured to target passwords stored in web browsers, Nikke account details, and information from 28 types of cryptocurrency wallets. It also reportedly targeted SSH security keys and cloud access credentials used by developers. Inven adds an important limitation from the report: it was not described as harvesting every general password stored in Windows, but as extracting information tied to specific browser, wallet, account, and development-tool targets.
The platform exposure is wider than a simple Windows-only warning. Inven reports that Linux and Steam Deck users running the game through compatibility software such as Proton are exposed to the same risks. That does not mean every Steam Deck or Linux user is confirmed infected. It means the reported attack path, launcher execution through compatibility layers, was considered viable by the researcher as summarized by Inven. For a PC player, the safe assumption is based on behavior rather than hardware branding: if you opened the Goddess of Victory Nikke PC launcher during the reported risk window, treat the machine as potentially exposed until checked.
Safest immediate steps for anyone who opened the launcher
The most conservative move is to stop opening the Nikke PC launcher until you have applied the official update and seen follow-up guidance from Shift Up or Level Infinite. Automaton West’s original guidance, before the update, advised players not to open the launcher until the developers confirmed resolution and to clear cache before running it again. Shift Up has since implemented fixes, per Automaton West’s update, but the company was still investigating impact in the cited notice. That means the patch is a major step, not a complete public accounting of who was affected.
For a quick local check, Inven reports that the researcher advised opening Launcher/intl_service/debug.log inside the Nikke installation directory and searching for the string k2f_chan. According to Inven, finding that string indicates traces of malware execution. Treat that as a warning flag, not as a full diagnostic. The provided Inven excerpt cuts off as it begins a caveat about absence, and no source here supports saying that a clean search proves the machine was never exposed.
If you find k2f_chan, or if you opened the launcher during the reported October 24 to November 4 window and handle sensitive accounts on that PC, act as if credentials may have been observed. Disconnecting the machine from sensitive sessions, changing account passwords from a separate trusted device, revoking active sessions where services allow it, rotating SSH keys and cloud tokens if you use them, and checking cryptocurrency wallet exposure are reasonable next steps based on the capabilities Inven attributes to the reported malware. This is especially important for developers, creators, and anyone using the same PC for work credentials, because Inven says the target list included SSH security keys and cloud access credentials.
Do not rely on reinstalling the game alone as a cure. The reported agent could register itself in Chrome on Windows and continue operating after the launcher was closed, according to Inven’s summary of the technical report. That claim still comes from the researcher’s analysis as reported by Inven, not from a final publisher postmortem, but it raises the risk level. If a PC shows signs of execution, use reputable security tools and official remediation instructions once Shift Up or Level Infinite publishes them. If the system carries high-value credentials, a deeper incident-response approach is safer than treating this like a bad cache file.
The unanswered questions are now on Shift Up and Level Infinite
The biggest missing answer is how an unknown party allegedly modified files on official distribution infrastructure. Inven states that how attackers obtained authorization to modify files on official servers remains unknown, as does the actual scope of user damage. Those are not small follow-up details. For a live-service launcher, file integrity is part of the trust contract between publisher and player.
Players also need a clear official exposure window. The researcher timeline reported by Inven and Automaton points to October 24 as the latest confirmed point when the attack could install a remote-control agent, while the file tampering allegedly began on September 27. Shift Up’s update confirms possible third-party tampering and the November 4 fix time, but the cited sources do not include a final official statement defining who is affected, which launcher versions are safe, whether cache clearing is required, or how the company will notify users who may have been compromised.
There is also an account-security question specific to Nikke. Inven reports that Nikke account details were among the targets. If that finding is validated, players will need more than a launcher update. They will need guidance on password resets, session invalidation, account recovery, and whether any in-game or linked-account systems were accessed. The provided sources do not confirm account theft at scale, so that cannot be treated as established fact. It is, however, a direct risk named in the technical reporting.
How to play this safely from here
For now, the safest path is patience and verification. If you have not opened the Goddess of Victory Nikke launcher during the reported risk window, wait for the official follow-up notice and make sure any future launch uses the fixed client. If you did open it, check the debug log for k2f_chan, keep an eye on official Nikke channels, and handle sensitive credentials from a clean device until you are confident the PC is clear.
This is a frustrating situation because the reported attack path punishes normal player behavior. PC players should not need to audit CDN-delivered launcher scripts before logging in. Still, the right response is controlled and practical. Do not panic-install random cleanup tools from search results. Do not assume silence means safety. Do not treat the November 4 fix as proof that prior sessions were clean. The confirmed patch addresses the launcher side, while the still-open question is whether any individual machines were hit before that patch landed.
GameLoop will treat the MotherSphere findings as reported technical allegations until they are fully confirmed by the operator, while treating Shift Up’s November 4 acknowledgement and client fix as confirmed through Automaton West’s cited update. For Goddess of Victory Nikke PC users, that split is the key: the launcher has received an official fix, but the safest next steps depend on whether your machine may have run the launcher during the reported exposure window and whether local checks show signs of execution.