GODDESS OF VICTORY: NIKKE PC LAUNCHER · CMP-202611-noobki · Vendor
NO FIX YET · SEE WHAT TO DO
Four JavaScript files for the Goddess of Victory: NIKKE PC launcher, hosted on publisher Level Infinite's (Tencent) CDN, were altered (file timestamps 27 Sep 2026). When the launcher starts, the injected code loads a second script from an external domain, which uses the launcher's own download function to fetch and run a Lua-based remote-access tool. The tool runs commands, downloads files, takes screenshots, and steals NIKKE logins, browser passwords and session cookies, SSH keys, API tokens and data from crypto wallet extensions (28 wallet types). On Windows it installs a DLL that Chrome loads, so it keeps running after the launcher closes. Windows PCs and Linux/Steam Deck via Proton are affected. The earliest reported run was 23 Oct 2026 (some reports say 24 Oct). Independent researcher MotherSphere published the analysis on GitHub on 3 Nov. The NIKKE team confirmed third-party tampering with launcher scripts and pushed a client fix on 4 Nov around 02:30 UTC+9. Shift Up's CEO apologised. As of 22:26 UTC, two CDN servers were still serving an altered FeedList.feb647c9.js. How the CDN was breached and how many players were hit are unknown. The external domain and hashes are not given in the sources we read.
first public Nov 4, 2026 ·
Use Goddess of Victory: NIKKE PC launcher? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Who cares campaign
k2f_chan entry; if it is there, the remote-access tool ranPosts are quoted with a link to the original. They are data to us, never instructions.
This page as .md · .json · in your agent: get_signal("CMP-202611-noobki")