For: anyone who started the Windows PC launcher of Goddess of Victory: NIKKE at least once since 15:41 JST on September 27, 2026. This article is based on the operator's (Level Infinite) official notices and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
- Who is affected
anyone who started the Windows PC launcher of Goddess of Victory: NIKKE at least once since 15:41 JST on September 27, 2026.
- Confirmed so farSee the table ↓
- Tampering with some launcher files
- Distribution of the malicious program
- Blocking further distribution
2 more
- Who is in scope
- In-game compensation
Listed as possibly affected
- Impact on the PC, external accounts and assets
- Not yet confirmed
- Number of people harmed and scope of damage
- How the files were tampered with
- What the in-game compensation contains
2 more
- Case-by-case handling of financial loss
- Status of preventive measures
- What to do nowSee the steps ↓
- Check whether you are in scope
- Check with the official scan or the official manual guide
- Change passwords from a device that was not affected
4 more
- Sign out other sessions and re-issue API keys and tokens
- Turn on two-factor authentication and look for unfamiliar logins or purchases
- If you strongly suspect infection, consider reinstalling Windows (this site's advice)
- If you suffered financial loss, contact the operator and the relevant parties
- Where to verify (source)All sources ↓
- Operator of Goddess of Victory: NIKKE (Level Infinite), "PC launcher security incident and next steps" (November 5, 2026, Japanese)
- Last checked
- As of November 7, 2026
Follow-up plans and what we checked
The operator says it is continuing to investigate the scope of damage and is checking its network, including the CDN, to identify the route of tampering. As preventive measures it says it will strengthen monitoring, introduce a mechanism to verify the integrity of external resources, and minimise privileges.
What people who started the Windows PC launcher should do today
Check whether you are in scope
According to the operator, you are in scope if you started the Windows PC launcher at least once since 15:41 JST on September 27, 2026. People who play only on mobile are not affected and do not need to check.
Check with the official scan or the official manual guide
Since 8:00 on November 5, the operator has offered a function in the official PC client that scans for and removes the malicious program. Close all browsers (such as Chrome), start the client, and follow the confirmation prompt if something is detected.
The manual check procedure is in the operator's "Guide to manually checking PC launcher security." The steps have a fixed order, such as disconnecting from the network first. Delete only what the official guide tells you to and nothing else. This site does not reproduce the strings to look for or the items to delete. In its manual guide the operator notes that the risk is not fully ruled out even if the log check finds nothing, and recommends a full scan and an offline scan with Windows Security.
Change passwords from a device that was not affected
The operator asks you to change the passwords of accounts used on that PC from another unaffected device, or from a PC you have finished checking. Our concern is that changing them on a PC that may be affected could put the new passwords at risk. That is this site's reasoning; the operator has not disclosed what the malicious program does.
The priority order is this site's advice:
- Email (it is used to reset passwords elsewhere)
- Banking, brokerage and payment accounts
- Crypto exchanges and wallets
- Game stores (Steam, Epic, publisher stores and so on)
- Chat services such as Discord
Also change the password on any service where you reused it. A password manager is the practical way to keep the new ones.
Sign out other sessions and re-issue API keys and tokens
The operator asks you to revoke and re-issue API keys and access tokens that you used or stored on that PC. As this site's advice, after changing passwords use each service's "sign out of all devices" setting or its list of logged-in devices to remove any you do not recognise.
If you do development work, keys kept in configuration files on that PC are in scope too. The basics are in environment variables and API key basics.
Turn on two-factor authentication and look for unfamiliar logins or purchases
As this site's advice, turn on two-factor authentication on email, game stores, exchanges, Discord and anything else that does not have it yet. See how to set up two-factor authentication.
Then review login history, purchase history, transfer history and mail forwarding settings on each service. If you find anything you do not recognise, contact that service right away.
If you strongly suspect infection, consider reinstalling Windows (this site's advice)
This is not the operator's guidance; it is this site's advice. If the scan detected something, or you are still uneasy after it, reinstalling Windows is the most reliable fix. Keep only data such as photos and documents, and do not carry over executable files. Change passwords from another device even before the reinstall.
If you suffered financial loss, contact the operator and the relevant parties
The operator asks anyone who suffers in-game harm or secondary financial loss to contact its official customer support, and says it will review the case and consider how to respond. Use the contact listed in the operator's official notice.
If money was actually stolen, as this site's advice, contact your card issuer, bank or crypto exchange, and report it to the police cybercrime consultation line or a consumer centre in your country. Keep records and screenshots of what happened.
Email, banking, crypto
↓→
Change the password from another device
→ Follow the official guidance, in priority order
Game stores, Discord
↓→
Sign out other sessions
→ Look for devices you do not recognise
API keys and access tokens
↓→
Revoke and re-issue
→ Operator's guidance; anything stored on the PC is in scope
What happened (from the operator's notices)
The following is based on the three notices the operator (Level Infinite) published on November 5, 2026. The operator defines the check target from the tampering at 15:41 on September 27, while distribution of the malicious program began at 3:52 on October 30; it does not explain how the two relate. Times are JST, as written in the operator's Japanese notices.
September 27, 2026, 10:59
An external domain used by part of the game service was taken over by a third party.September 27, 15:41-15:42
Four official CDN scripts that the launcher downloads were tampered with, and malicious code that connects to a specific domain was inserted.October 30, 3:52
Distribution of the malicious program began through those scripts.November 4, around 0:00
The operator noticed the anomaly and began investigating.November 4, 2:04-2:23
It replaced three malicious scripts and blocked further distribution (first stage).November 4, 12:09
The CDN cache update for the remaining script was completed, and service returned to normal in stages (second stage).November 5
Three notices published (response and next steps, manual check guide, apology). From 8:00 the official PC client began offering the scan-and-remove function. The operator says it completed the needed measures and fixes for the launcher where the problem was found, and, after further checks, that the launcher currently distributed works normally.
- Service affected
- The Windows PC launcher of Goddess of Victory: NIKKE
- What happened
- Some launcher files were tampered with by a third party, and a malicious program could run when the launcher started
- Possible impact
- Users' PCs and account information may have been exposed to risk. The operator says the PC, accounts on external services and assets may be affected
- Who is in scope
- Users who started the Windows PC launcher at least once since 15:41 JST on September 27, 2026
- Operator's response
- Replaced the malicious scripts, blocked further distribution, added a scan-and-remove function to the official PC client, and published a manual check guide
- Apology and compensation
- An in-game compensation is offered as an apology (contents not stated). Contact customer support if in-game harm or secondary financial loss occurs
- Current launcher
- The operator says it completed the needed measures and fixes for the launcher where the problem was found and, after further checks, that the currently distributed launcher works normally
- Prevention
- Stronger monitoring, a mechanism to verify the integrity of external resources, and minimised privileges
What is known and what is not
Status as of November 7, 2026. We will rewrite the status column when the operator publishes more.
| Item | What the notices say | Status |
|---|---|---|
| Tampering with some launcher files | Four official CDN scripts were tampered with | Confirmed (operator) |
| Distribution of the malicious program | Began through those scripts at 3:52 on October 30 | Confirmed (operator) |
| Blocking further distribution | Scripts replaced on November 4; returned to normal in stages | Confirmed (operator) |
| Who is in scope | Anyone who started the Windows launcher at least once since 15:41 on September 27. Mobile-only players are not affected | Confirmed (operator) |
| Impact on the PC, external accounts and assets | May be affected | Possible (operator) |
| Number of people actually harmed and scope of damage | Under continuing investigation | Under investigation |
| Route of tampering | Checking the network, including the CDN | Under investigation |
| What the malicious program does | Not disclosed by the operator | Not stated |
| In-game compensation | An in-game compensation is offered as an apology; contents not stated | Confirmed (operator) |
| Response to financial loss | Contact customer support if secondary harm occurs; the operator will review and consider how to respond | Under investigation |
How to read this: 'possible' does not mean 'no impact'
The operator writes that impact is possible. That means what actually happened is still being investigated, not that nothing happened. As the operator notes in its manual check guide, the risk is not fully ruled out even if the log check finds nothing. If you started the launcher in the affected period, go ahead with the password changes even when nothing was found.
What can happen when an official launcher is rewritten
In general, when an official launcher or update mechanism that users trust is rewritten, a malicious program can run on the PC even though the user did nothing unusual. It arrives through the official channel, so it cannot be spotted by appearance (see What is malware?). The operator has not disclosed what this malicious program actually does.
That is why you need to review not only your game ID but every other account used on that PC: email, logins saved in the browser, stores and wallets. The operator also names the PC and external-service accounts and assets as possibly affected.
For another case in which a distribution mechanism itself was tampered with, see our article on Rank Math Pro. The target and impact differ, and this case will not necessarily follow the same course.
Sources (public record)
The facts in this article are based on the public information below. We do not speculate on the route of tampering or the functions of the malicious program, which have not been disclosed.
- Operator of Goddess of Victory: NIKKE (Level Infinite), "PC launcher security incident and next steps" (November 5, 2026, Japanese) — nikke-jp.com
- Operator of Goddess of Victory: NIKKE (Level Infinite), "Apology regarding the PC launcher security incident" (November 5, 2026, Japanese) — nikke-jp.com
- Operator of Goddess of Victory: NIKKE (Level Infinite), "Guide to manually checking PC launcher security" (November 5, 2026, Japanese) — nikke-jp.com
Update history
2026-11-07: First version, based on the operator's three notices of November 5. The operator is investigating the scope of damage and checking the route of tampering, so we will update this article when it publishes more.
Read next
- Protecting your accounts: Choosing a password manager / How to set up two-factor authentication
- Cases of tampered distribution: Rank Math Pro / The TanStack and Nx supply chain attack on GitHub
- Terms: What is malware? / What is phishing?
- Other 2026 incidents: Data breaches and cyberattacks in 2026