Developer Shift Up and publisher Level Infinite, a subsidiary of the Chinese tech giant Tencent, have faced a major cybersecurity incident. The PC version of the popular mobile shooter Goddess of Victory: NIKKE reportedly became a tool for malware distribution: attackers allegedly breached Tencent's CDN infrastructure and injected a Remote Access Trojan (RAT) into the November launcher update. The incident has sparked a wave of discontent within the gaming community and cast doubt on the security systems of the Asian media giant.
How the attack worked: from CDN to infected launcher
According to the incident report, the attackers gained access to the publisher’s internal systems and maintained it for over a month before moving to the active phase of injecting malicious code. As a result, a trojan was embedded into the game's November update, spreading through the legitimate client update channel. This scenario is characteristic of supply chain attacks: the user, trusting the official launcher, unknowingly downloads the malicious component to their device.
Capabilities of the embedded trojan
According to the incident characteristics, the injected remote access agent is capable of scanning the file system, intercepting passwords, and extracting cryptocurrency wallet data. The combination of these capabilities points to the attacker's objective — not just intelligence gathering, but also direct theft of users' digital assets, including crypto wallets, making the incident potentially financially damaging for those affected.
A month in the system and researcher domain takeover
Currently, a warning has reportedly appeared in the game launcher, posted by a third-party security researcher who allegedly managed to intercept control of the command-and-control domain from the hackers. This means the malicious channel has been forcibly redirected to the defense side: instead of downloading the trojan, users now see a warning. Official damage estimates are currently being clarified, and the provided materials do not contain independent verification of the incident details from the publisher.
Community reaction and questions regarding Tencent's security
The compromise of Level Infinite’s infrastructure has already sparked frustration among players: users are debating the reliability of the security systems that allegedly allowed the intruders to remain in the system for over a month. For a publisher within the Tencent ecosystem, such an incident serves as a public test of reputation and threat response procedures. Those who may have installed the infected update are advised to follow the instructions provided in the source and perform basic isolation measures: change passwords, check crypto wallets, and scan the system with an up-to-date antivirus solution.
