Goddess of Victory: NIKKE PC Launcher Compromised by Malware: How to Check debug.log and Secure Your Accounts
PC players of Goddess of Victory: NIKKE are facing a critical cybersecurity alert. The official Windows launcher for the hit sci-fi shooter developed by Shift Up and published globally by Tencent's Level Infinite was compromised in a supply-chain attack. Unauthorized script modifications allowed a remote-access payload to execute silently on machines where players opened the PC client over the past several days.
A CDN Supply-Chain Breach Active Since Late September and Critical in Late October
The vulnerability was first documented by community security analysts and independent researcher MotherSphere on GitHub before being formally acknowledged by the South Korean developer. Technical analysis revealed that third-party threat actors managed to tamper with JavaScript files hosted directly on the official Content Delivery Network (CDN) serving the PC launcher.
While the initial script alterations reportedly appeared on the servers as early as September 27, 2026, the malicious payload escalated into an active threat between October 23 and October 24, 2026. Simply opening the official Windows launcher was enough to trigger a remote-control agent written in Lua, even before launching the game binary itself.
Once running in the background, the unauthorized Lua agent possessed extensive system capabilities:
- Executing arbitrary system commands and capturing real-time monitor screenshots;
- Browsing and exfiltrating local files, specifically targeting developer credentials and SSH keys;
- Stealing saved browser passwords and active session cookies across major platforms (Google, Steam, Discord, YouTube), allowing attackers to bypass standard two-factor authentication prompts;
- Targeting cryptocurrency wallet browser extensions and modifying browser DLL files (such as Chrome DLLs) to maintain system persistence.
Shift Up's Official Response and the November 4 Emergency Patch
Just days after celebrating the upcoming NIKKE crossover DLC in Stellar Blade Complete Edition on Switch 2, Shift Up issued an official security notice on the Goddess of Victory: NIKKE portal in the early hours of November 4 confirming the breach and detailing its initial remediation steps:
"We have identified an issue indicating that the PC launcher's script files may have been modified by a third party. Accordingly, client fixes and an update were implemented on November 4 at approximately 02:30 (UTC+9). We are currently investigating the full extent of the impact caused by this issue, and we will provide additional details regarding follow-up measures in a separate notice. We apologize for the inconvenience caused."
As Shift Up's flagship live-service revenue driver for the past four years within a South Korean mobile and cross-platform market heavily reliant on high-spending players, restoring trust in the PC client will require complete transparency.
How to Check Your PC for Infection via debug.log
If you opened the Goddess of Victory: NIKKE PC launcher at any point between October 23 and November 4, 2026, do not rely solely on the automatic launcher update. You can quickly verify whether your client interacted with the malicious script by inspecting a local log file:
- Open Windows File Explorer and navigate to your game installation directory, specifically inside the
NIKKELauncherintl_servicefolder; - Open the
debug.logfile using Notepad; - Press
Ctrl + Fand search for the exact stringk2f_chan; - If
k2f_chanappears in the log file, your launcher instance directly loaded and interacted with the compromised script payload.
If you find the k2f_chan indicator (or if you want to take full precautions after running the launcher in late October), security researchers strongly advise following these steps immediately:
- Disconnect the affected PC from the internet right away;
- Using a separate, clean device (such as your smartphone), change your passwords starting with your primary email account, followed by Steam, Discord, financial services, and social media;
- Revoke all active sessions ("Sign out of all devices") across every major account: because stolen session cookies allow attackers to hijack logged-in accounts without needing your password or 2FA code, invalidating active tokens server-side is essential;
- Perform a clean Windows reinstallation from a bootable USB drive if
k2f_chanis present in your logs, as the Lua agent could modify browser DLLs or establish persistence that survives a standard game uninstall.
My Take
This fiasco highlights the single worst habit in modern PC gaming: publishers forcing half-baked proprietary launchers onto players instead of delivering native builds through established platforms like Steam. Under the hood, too many of these custom standalone clients are glorified WebView wrappers executing remote JavaScript with wide-open local system privileges. When a compromised CDN script can silently deploy a Lua agent that scrapes session cookies, browser DLLs, and SSH keys just because someone opened a launcher to clear their daily missions, that goes way beyond a minor bug. Until Shift Up and Level Infinite publish a full post-mortem audit detailing how their CDN was breached, keep the launcher closed and check your debug.log immediately.
SEO consultant for over 20 years and digital entrepreneur, Charles "Grimtag" is the founder of Pro-Gamer.gg, Retrocharting.com, and Gamescharting.com. A competitive gamer, streamer, and retro game collector, he has worked in the video game industry for over 15 years, notably as a consultant for leading game price comparison platforms. Passionate about real-time performance data and gaming technology, he analyzes competitive esports, gaming hardware benchmarks, and creator workflows on Pro-Gamer.gg with an authentic player perspective.
