Level Infinite has apologized to players after third parties tampered with files used by the Windows PC launcher for GODDESS OF VICTORY: NIKKE, Chosun’s English edition reported on November 5, 2026. The NIKKE launcher malware incident matters because the code arrived through an official program that players opened on purpose. Level Infinite says user PCs and account information may have been exposed, and the full impact is still under investigation.
In the same Chosun report, Level Infinite is quoted as saying: “We deeply apologize for the significant anxiety and concern caused by this security breach in our PC launcher.” The notices add that tampered script files could let malicious programs run whenever the launcher was opened. The company has since shipped a client fix and started automatic malware detection and removal inside the official PC client.
This is a textbook trust-chain failure, and it echoes other recent cases where attackers skipped the front door. Our report on the fake job interview that led to the $6.3B Binance hack showed how a believable workflow beats a firewall. Here the believable workflow was a game launcher. Below we walk through the dates, what is confirmed, what is not, and what PC players should do today.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
NIKKE Launcher Malware Timeline: Sept. 27 to Nov. 5
The sequence of dates is the most useful thing to understand first, because it tells each player whether they sit inside the exposure window. Reports say four official CDN script files were tampered with on September 27. Level Infinite’s security notices say distribution of malicious programs through the compromised script began on October 30 at 03:52 UTC+9. Client fixes and an update followed on November 4 at roughly 02:30 UTC+9.
| Date | Event | Basis |
|---|---|---|
| September 27 | Four official CDN script files reported as tampered with | Press reports on the incident |
| September 27, 15:41 | Reference point: players who ran the Windows PC launcher at least once after this moment are urged to run a security check | Level Infinite notice |
| October 30, 03:52 UTC+9 | Distribution of malicious programs through the compromised script begins | Level Infinite notice |
| November 4, ~02:30 UTC+9 | Client fixes and an update implemented | Press reports on the fix |
| November 5, 08:00 | Automatic malware detection and removal begins in the official PC client | Level Infinite notice |
| November 5 | Public apology from Level Infinite and the NIKKE operations team | Chosun, Inven Global |
Count the days and an uncomfortable picture appears. By our calculation from the reported dates, 33 days passed between the script tampering on September 27 and the start of malware distribution on October 30. Another five days passed before the client fix on November 4. In total, 38 days separate the first tampering from the first remediation. The reports we reviewed do not explain the gap between the first two dates, and we will not guess at it.
How a Tampered CDN Script Turns a Launcher Into a Delivery Vehicle
Modern game launchers are rarely a single static program. Many act as thin shells that pull scripts, news panels, and configuration from a content delivery network each time they start. That design lets publishers update a launcher without shipping a new installer. It also means whoever controls those remote files controls what the launcher does on the player’s machine.
Level Infinite’s account matches that pattern. The company says third parties tampered with files or script files used by the PC launcher, which could allow malicious programs to run when the launcher was opened. Players did nothing unusual. They clicked the same icon they always click.
What changed on September 27
Four official CDN script files were reported as tampered with on that date. Four is a small number, and that is the point. An attacker does not need to rewrite a game client or breach a studio’s build servers when a handful of remote scripts get loaded with trust by default. The files looked official because they were served from official infrastructure.
Why October 30 mattered
The October 30 timestamp, 03:52 UTC+9, marks when Level Infinite says malicious programs began spreading through the compromised script. For players, that is the date where risk moves from theoretical to active. The company still urges anyone who launched the client after September 27 at 15:41 to check their machine, which is the cautious reading of the earlier tampering date.
What Level Infinite and SHIFT UP Said in Their Apologies
The tone of the response is notable for what it admits. In the statement carried by Inven Global, the NIKKE operations team said: “It should never happen that an official program executed to enjoy the game could instead threaten the security of our players.” The same statement added: “We feel deep responsibility as a publisher for failing to safely provide a service that players should be able to use without hesitation.”
Inven Global also reported a personal apology from Kim Hyung-tae, CEO of SHIFT UP, who wrote: “A problem related to the PC launcher has occurred.” He added: “In cooperation with Level Infinite, we are mobilizing all our resources to find a fundamental solution to this matter, and we are also preparing follow-up measures.” SHIFT UP is the studio behind the game, while Level Infinite acts as its publisher.
Two things stand out in these statements. First, neither one blames players or hides behind passive phrasing about “unauthorized activity.” The publisher takes responsibility in plain terms. Second, the CEO language about follow-up measures signals that more disclosure and more changes are coming. That fits the open questions listed later in this piece.
What Reports Say the Malware Could Do
Level Infinite has been careful with its wording on impact. The company says PCs and account information may have been exposed to security risks. Outside outlets have been more specific about capability. BleepingComputer’s headline describes the launcher as hacked to spread remote access, data-stealing malware. VGTimes, in its own warning to players, said the virus steals passwords and crypto wallets.
Treat those descriptions as capabilities, not proven losses. The reports we reviewed describe what the malicious code could do or was designed to reach. They do not establish that any named player’s credentials, wallet data, screenshots, or files were actually stolen. That distinction shapes the advice later in this article. A remote-access tool on a PC is serious on its own, so players should respond to the possibility even without proof of theft.
Security teams will recognize the shape of the threat. Malware that runs with the permissions of the logged-in user can reach whatever that user can reach, including browser sessions, saved logins, and developer tokens on a machine used for both work and play. Gamers who also write code or manage cloud accounts on the same PC carry the highest downside.
What Is Confirmed and What Remains Unconfirmed
With a fast-moving incident, separating fact from inference protects readers. The table below sorts the claims we can source from those we cannot.
| Claim | Status | Source basis |
|---|---|---|
| The Windows PC launcher for NIKKE was involved | Confirmed | Level Infinite, Chosun |
| Third parties tampered with launcher files or scripts | Confirmed | Level Infinite, Chosun |
| Four official CDN script files were tampered with on September 27 | Reported | Press reports |
| Malware distribution began October 30 at 03:52 UTC+9 | Confirmed | Level Infinite notice |
| Fix and update shipped November 4 at roughly 02:30 UTC+9 | Reported | Press reports |
| Automatic detection and removal started November 5 at 08:00 | Confirmed | Level Infinite notice |
| Exact number of affected users | Unconfirmed | Not established |
| Number of confirmed infections or data thefts | Unconfirmed | Not established |
| Identity of the attacker | Unconfirmed | Not established |
| Financial losses | Unconfirmed | Not established |
| Completed theft of credentials, wallet data, or files from specific users | Unconfirmed | Described as capability or risk |
The left column of unconfirmed items deserves attention. Any figure for victims, losses, or suspects that does not appear in Level Infinite’s notices or the cited reports should be treated as unverified, so we do not repeat any here.
Who Needs a Security Check Right Now
Level Infinite’s guidance is direct. Anyone who ran the Windows PC launcher at least once after September 27 at 15:41 should perform a security check. That covers a wide group. A player who opened the launcher once on October 1 is inside the window, even though the company dates active malware distribution to October 30.
Mobile-only players are not described as affected in the reports we reviewed, since the incident centers on the Windows PC launcher. Players who installed the launcher but never opened it after the date also sit outside the stated trigger. When in doubt, a scan costs little and an undetected remote-access tool costs a lot.
The official notice is hosted on the NIKKE website, and players should read it directly instead of relying on screenshots shared in chat servers.
Cleanup Steps for Players on Windows
Level Infinite began automatic malware detection and removal inside the official PC client on November 5 at 08:00. That helps, but it should not be the only line of defense. A machine that ran the compromised launcher before the fix may hold components the client cannot see. Here is a sensible order of operations, drawn from the company’s guidance and standard incident-response practice.
- Update the NIKKE PC client to the latest version so it carries the November 4 fix and the new detection routine.
- Disconnect the PC from the network if you suspect it ran the launcher during the exposure window.
- Run a full antivirus scan. Our walkthrough on running a Microsoft Defender Offline scan on Windows 11 covers a method that catches threats hiding from a running system.
- From a different, clean device, change passwords for email, banking, game, and exchange accounts. Revoke active sessions where the service allows it.
- Rotate any API keys, SSH keys, or cloud tokens stored on the affected PC.
- If you hold cryptocurrency in a browser wallet on that machine, move funds using a clean device and generate a new seed phrase.
- If anything still looks wrong, follow a full removal process such as our guide to removing malware from a PC in 13 steps.
A community-maintained triage guide on GitHub also lays out how to check a PC and when a full Windows reinstall is or is not warranted. It is unofficial, so cross-check anything it says against Level Infinite’s own notice before acting. Most players will not need a wipe, but people who handle money or production credentials on the same PC should weigh it seriously.
Why Game Launchers Make Attractive Supply-Chain Targets
Attackers go where trust is cheap. A game launcher sits on many players’ PCs, runs with the user’s rights, gets allow-listed by antivirus without a second thought, and often asks for firewall exceptions during install. Players actively click through warnings to get to the game.
Gaming PCs also tend to hold a rich mix of data. Many players keep exchange accounts, Discord sessions, streaming credentials, and sometimes work logins on one machine. That combination makes a launcher compromise more valuable than a single-purpose app compromise.
Defenders in other fields have started to treat code delivery as a signing problem. Teams that ship containers, for example, increasingly verify provenance before anything runs, as our tutorial on Cosign image signing with Kyverno explains. Consumer launchers rarely apply the same discipline to remote scripts, and this incident shows the cost of that gap.
Competitive Comparison: How This Incident Differs From Other Trust Failures
Comparing incidents helps show what is unusual here. The table below uses facts from our earlier coverage and from the NIKKE reports. Scale figures for NIKKE stay blank because none have been confirmed.
| Incident | Entry point | Reported scale | Response |
|---|---|---|---|
| NIKKE PC launcher | Tampered CDN script files used by an official launcher | Not established | Apology, client fix, automatic removal |
| Binance hack | Malware delivered through a fake job interview, per our coverage | $6.3B | Exchange statements and a confidence plan |
| Videostrong boxes | Botnet in Android TV boxes, per our coverage | 1.3 million boxes | Google cut off the vendor |
The Videostrong case, which we covered in Google’s move against a 1.3-million-box botnet, centered on Android TV boxes that people bought. NIKKE differs because the malicious change reached players through a vendor-controlled script path, not a hardware purchase. In both cases, users trusted a vendor-supplied component and paid for it.
Historical Context: A Long Line of Poisoned Updates
Supply-chain compromise is not new. The CCleaner installer incident, the SolarWinds Orion build compromise, and the 3CX desktop app compromise all showed that attackers can ride a vendor’s update channel into thousands of networks. Each case taught the same lesson: the more users trust an update path, the more an attacker gains by owning it.
What changes in the NIKKE case is the sector and the target profile. Those older cases focused on enterprise networks and government systems. This one lands on consumer gaming PCs, where logging is thin, patching is uneven, and nobody on the household “IT team” reads indicators of compromise. Our overview of patch management software shows how much tooling businesses use for this problem, and home users have almost none of it.
Market Impact for Publishers and Studios
No sales, revenue, or player-count data tied to this incident appears in the reports we reviewed, so any market-impact claim stays qualitative. Still, the direction is clear. Publishers that run their own launchers now have a live example of how a small set of remote files can hurt user trust.
Three effects seem likely. First, security reviews of launcher code and CDN configuration will move up on engineering roadmaps. Second, players will ask harder questions before installing publisher-specific launchers, and storefront clients may gain an edge in perceived safety. Third, legal and regulatory teams will watch how Level Infinite reports on affected users, since data-exposure rules in some regions set disclosure clocks. These are our readings of the situation, not announced facts.
The company’s response speed will also shape perception. Level Infinite moved from fix to automatic removal in about a day, which is quick. The longer question is whether it publishes a post-incident write-up that names the root cause, because that is what rebuilds trust among security-minded players. For more coverage of defensive tooling and breach response, see our cybersecurity section.
5 Predictions for the Aftermath
These are analyst-style forecasts based on how similar incidents have played out. None come from Level Infinite or SHIFT UP.
- A detailed post-incident report will follow. The CEO’s mention of follow-up measures points that way, and security-minded players will demand it.
- Affected-user numbers will surface, or the lack of them will become the story. The count is currently unconfirmed, and pressure to quantify exposure will grow.
- Publishers will pin and sign launcher scripts. Expect more studios to ship scripts inside the signed client or to verify remote files before executing them.
- Attackers will copy the method. Tampering with CDN-hosted files is cheap to repeat against any publisher with weak access controls.
- Players will move toward fewer launchers. Where a storefront client offers the same game, some users will choose it to cut their attack surface.
What Publishers and Security Teams Should Take From This
For publishers, the first lesson is to treat every remotely loaded script as code that deserves the same review as a build artifact. That means locked-down write access to CDN buckets, change alerts on production script files, and integrity checks inside the launcher before anything executes. The second lesson is monitoring. Four modified files went live, and malicious distribution began later according to Level Infinite’s notice. Scheduled hash comparisons on production scripts are a cheap way to flag that kind of change.
For corporate security teams, the incident is a reminder that employees’ personal gaming habits touch company risk. A developer who plays on a machine that also holds cloud tokens creates an indirect path into the business. Endpoint policies should cover personal use on managed devices, and credentials should never sit in browser stores on shared PCs. Alerting on new remote-access software helps catch what slips through.
For players, the practical rule is simple. Keep gaming and sensitive accounts on separate machines or separate user profiles, use a password manager with a separate master secret, and keep hardware wallets for cryptocurrency instead of browser extensions.
Frequently Asked Questions
What happened to the NIKKE PC launcher?
Third parties tampered with files or script files used by the Windows PC launcher for GODDESS OF VICTORY: NIKKE. That could let malicious programs run when the launcher was opened. Level Infinite issued an apology and security notices.
When did the malware start spreading?
Level Infinite says distribution of malicious programs through the compromised script began on October 30 at 03:52 UTC+9. Reports say four official CDN script files were tampered with earlier, on September 27.
Who should run a security check?
Level Infinite urges anyone who ran the Windows PC launcher at least once after September 27 at 15:41 to perform one. Players who used only the mobile version are not described as affected in the reports we reviewed.
Is the problem fixed?
Client fixes and an update went out on November 4 at roughly 02:30 UTC+9. Automatic malware detection and removal in the official PC client began on November 5 at 08:00. The full impact is still under investigation, so a fixed client does not prove that a given PC is clean.
Was my data stolen?
Nobody can say yet. Level Infinite says PCs and account information may have been exposed. Reports describe credential and wallet theft as capabilities or potential risks, and no completed thefts from specific users have been confirmed.
Who is behind the attack?
The attacker’s identity has not been established in the reports or notices we reviewed. Treat any named suspect on social media as unverified.
Do I need to reinstall Windows?
Not always. Update the client, run a full scan, change passwords from a clean device, and rotate keys and tokens. A reinstall makes more sense if scans find remote-access tools or if the PC held high-value credentials you cannot rotate quickly.
Will Level Infinite compensate affected players?
The notices we reviewed do not announce compensation, and financial losses have not been established. Inven Global’s headline says the company is accepting reports of secondary damage, so players who suffer losses can file them.
