Shift Up confirms NIKKE PC launcher tampering and deploys fix
Shift Up confirmed third-party tampering with the NIKKE PC game launcher and deployed a security update on November 4; the investigation is ongoing. The compromised files could install malware that steals browser passwords, accesses personal files, takes screenshots and collects cryptocurrency wallet data; the company has not confirmed how many players were affected or whether data was stolen. The community attributes the origin to the shared Level Infinite/Tencent launcher, with unconfirmed reports of other games affected; players should update the client and check their PCs.
What happened
Shift Up confirmed that third parties tampered with the NIKKE PC game launcher. The company deployed a security update on November 4 and the investigation is ongoing. It has not confirmed how many players were affected or whether any data was stolen.
Why it matters
The compromised files could install malware that steals browser passwords, accesses personal files, takes screenshots and collects cryptocurrency wallet data on players' PCs. Anyone who used the launcher before the fix may be infected, with risk of losing credentials and digital assets.
What to do
Update the NIKKE launcher to the fixed November 4 version before opening the game. Scan the PC with antivirus, change browser-saved passwords and keep cryptocurrency wallets off a suspect machine. Follow official NIKKE channels for investigation updates.
For the technical team
- Affected
- Shift Up / Level Infinite (Tencent) Nikke (cliente do jogo para PC); launcher desenvolvido em conjunto com a Level Infinite/Tencent · NIKKE PC client, by Shift Up, distributed through the shared Level Infinite/Tencent launcher, per community attribution. Unconfirmed reports cite other games tied to Level Infinite, including PUBG, Dune: Awakening and GTFO.
- Exploitation
- Tampering confirmed by Shift Up. Users reported infections since October 21, with theft of NIKKE credentials, browser passwords and cookies, and remote command execution. Number of victims and actual data theft remain unconfirmed.
- Fix
- Security update deployed by Shift Up on November 4. The four altered CDN scripts were already clean on servers verified on November 4, according to a researcher.
- Vector
- Supply chain attack: third-party-tampered files in the NIKKE PC launcher installed malware when players ran the launcher. A researcher documented four altered CDN scripts carrying a remote control agent. Exploitation requires running the compromised launcher.
- More details
- Before confirmation, a researcher noted the absence of a malware sample, hashes or verifiable technical proof. The community attributes the origin to the shared Level Infinite/Tencent launcher; unconfirmed reports cite PUBG, Dune: Awakening and GTFO. BleepingComputer reported the compromised launcher distributed remote access and data theft malware. Impact remains under investigation.
Timeline
Researcher documents a remote-control agent with command execution, file access and credential stealing in the four altered CDN scripts; the scripts were clean on checked servers as of November 4, and impact remains under investigation.
Unconfirmed reports suggest the flaw is not limited to NIKKE and has affected several games running software from an undisclosed publisher, including PUBG, Dune: Awakening, GTFO and others.
BleepingComputer coverage details that the compromised launcher distributed remote access and data-stealing malware.
Want the next updates in your inbox? Get the daily edition →
See all 10 updates
Community clarification: the flaw came from the shared Level Infinite/Tencent launcher, not Shift Up, and other games distributed via Level Infinite were affected.
Account tracking the case announces what is probably the final update to a tool related to the NIKKE client malware.
User reports infection dating back to October 21, with a roughly 200 KB payload that stole Nikke credentials, browser passwords and cookies and allowed remote command execution.
Shift Up confirms third-party tampering with the launcher and ships a security update on November 4; the number of affected players is still unconfirmed.
Researcher notes there is no official confirmation from Level Infinite or Shift Up and no malware sample, hashes or verifiable technical proof; the report remains unverified.
Users on X report infected machines after launching the PC client and urge others not to open the launcher until further notice; one says a full reformat is likely needed.
First public reports of malware in the Nikke PC game client circulate on social media.
Sources 12 sources
- @KOGG__ @KOGG__
- @Your_Lego_Guy @Your_Lego_Guy
- @RedShoesLabRat @RedShoesLabRat
- @KamiZxous @KamiZxous
- @SpringZ_FSG @SpringZ_FSG
See all 12 sources
- @Pirat_Nation @Pirat_Nation
- @ReneeBai_VT @ReneeBai_VT
- @Mother_Sphere @Mother_Sphere
- @TomVergz @TomVergz
- @BleepinComputer @BleepinComputer
- @Riju1T_T @Riju1T_T
- @DailyDarkWeb @DailyDarkWeb
