NIKKE PC Client Hacked, Exposing Users to Remote Access Threats
Hackers compromised JavaScript files in NIKKE's PC client between September 27 and October 30, injecting malware that allowed remote access to players' computers. The malicious code could steal sensitive data including passwords, cookies, and crypto wallet information. Developers patched the vulnerability by November 4 and urged users to update and scan their systems.
Between September 27 and October 30, 2026, hackers infiltrated the online servers of Level Infinite, the publisher of the globally popular RPG Goddess of Victory: NIKKE, by tampering with four JavaScript files within the game’s PC client. These compromised scripts were loaded by the NIKKE PC launcher upon startup, enabling attackers to deploy a remote-access agent on players’ machines. The malicious code allowed full access to sensitive data including login credentials, browser cookies, and cryptocurrency wallet information. The breach was discovered and mitigated when the compromised files were removed from servers on November 3, and Shift Up, the game’s developer, released a patched client update on November 4 at approximately 02:30 UTC+9. Level Infinite has since advised all users who launched the game during the attack window to update their client and perform a full system scan, recommending browsers be closed beforehand to ensure detection of residual malware. The company confirmed that both user PCs and account data may have been exposed, though it has not disclosed whether any accounts were compromised or if stolen data was used maliciously.
This incident follows a broader trend of escalating cyberattacks on game developers, particularly those with large player bases and digital infrastructure. The breach is especially concerning because it exploited the trust users place in official software updates—malware was delivered through legitimate client components, makin
The NIKKE breach underscores growing vulnerabilities in digital entertainment ecosystems where user trust is paramount. Players who invested time and money in a game now face potential identity theft, financial loss, or long-term surveillance—risks that could deter participation in online gaming, especially among less tech-savvy demographics. The incident may also accelerate regulatory scrutiny of game publishers’ cybersecurity practices, particularly those handling sensitive user data. Comparable to the 2017 Equifax breach, where a software flaw led to massive data exposure, this case highlights how third-party code dependencies can become systemic risks. Unlike traditional data leaks, remote access attacks like this one enable real-time exploitation, potentially leading to ransomware deployment or credential harvesting at scale. As game companies increasingly rely on cloud-based services and automated updates, the attack surface expands—raising questions about audit transparency and