---
title: "NIKKE launcher becomes RAT vector: researchers claim hackers held access to Level Infinite systems for a month"
description: "PC version of NIKKE becomes a RAT vector: researchers say hackers held access to Level Infinite systems for a month and injected a trojan into the November launcher update."
date: 2026-11-04T01:03:18.034Z
lang: en
url: https://xab.info/en/posts/nikke-pc-launcher-hacked-rat-tencent
tags: [cybersecurity, goddess-of-victory-nikke, tencent, level-infinite, shift-up, malware, rat-trojan]
author: "Alexander Buran"
publisher: "XAB.info"
---

# NIKKE launcher becomes RAT vector: researchers claim hackers held access to Level Infinite systems for a month

![Red warning notification about the compromise of the PC version of the game NIKKE](https://xab.info/media/2026/11/04/nikke-pc-launcher-vzloman-rat-tencent/nikke-pc-launcher-vzloman-rat-tencent-1.webp)

## Key Points

- The PC version of Goddess of Victory: NIKKE reportedly became a vector for RAT distribution via the November launcher update.
- Attackers allegedly maintained access to Level Infinite's internal systems for over a month before the active attack phase.
- The injected trojan is capable of scanning the file system, intercepting passwords, and uploading crypto wallet data.
- A third-party security researcher intercepted the command-and-control domain and placed a warning in the launcher.
- Official damage estimates are pending; no independent verification from the publisher is provided in the materials.

Developer Shift Up and publisher Level Infinite, a subsidiary of the Chinese tech giant Tencent, have faced a major cybersecurity incident. The PC version of the popular mobile shooter Goddess of Victory: NIKKE reportedly became a tool for malware distribution: attackers allegedly breached Tencent's CDN infrastructure and injected a Remote Access Trojan (RAT) into the November launcher update. The incident has sparked a wave of discontent within the gaming community and cast doubt on the security systems of the Asian media giant.

### How the attack worked: from CDN to infected launcher

According to the incident report, the attackers gained access to the publisher’s internal systems and maintained it for over a month before moving to the active phase of injecting malicious code. As a result, a trojan was embedded into the game's November update, spreading through the legitimate client update channel. This scenario is characteristic of supply chain attacks: the user, trusting the official launcher, unknowingly downloads the malicious component to their device.

### Capabilities of the embedded trojan

According to the incident characteristics, the injected remote access agent is capable of scanning the file system, intercepting passwords, and extracting cryptocurrency wallet data. The combination of these capabilities points to the attacker's objective — not just intelligence gathering, but also direct theft of users' digital assets, including crypto wallets, making the incident potentially financially damaging for those affected.

### A month in the system and researcher domain takeover

Currently, a warning has reportedly appeared in the game launcher, posted by a third-party security researcher who allegedly managed to intercept control of the command-and-control domain from the hackers. This means the malicious channel has been forcibly redirected to the defense side: instead of downloading the trojan, users now see a warning. Official damage estimates are currently being clarified, and the provided materials do not contain independent verification of the incident details from the publisher.

### Community reaction and questions regarding Tencent's security

The compromise of Level Infinite’s infrastructure has already sparked frustration among players: users are debating the reliability of the security systems that allegedly allowed the intruders to remain in the system for over a month. For a publisher within the Tencent ecosystem, such an incident serves as a public test of reputation and threat response procedures. Those who may have installed the infected update are advised to follow the instructions provided in the source and perform basic isolation measures: change passwords, check crypto wallets, and scan the system with an up-to-date antivirus solution.

## Fact-Check & Sources

- [Лаунчер Goddess of Victory: NIKKE был взломан и заражен вирусом](https://www.goha.ru/launcher-goddess-of-victory-nikke-byl-vzloman-i-zarazhen-virusom-d2yqYO) - The source describes a breach of Tencent's CDN infrastructure, RAT injection into the November launcher update, access held for over a month, and domain takeover by an independent researcher. Damage scale is pending clarification; no publisher confirmation is provided.

## FAQ

### What exactly happened with the PC version of NIKKE?

According to reports, a Remote Access Trojan (RAT) was injected into the November update of the Goddess of Victory: NIKKE PC launcher, distributed via compromised Tencent CDN infrastructure.

### What data could the trojan steal?

According to the incident report, the injected trojan is capable of scanning the file system, intercepting passwords, and extracting data from cryptocurrency wallets.

### Has the publisher confirmed the scale of the incident?

Official damage estimates are currently being clarified; the provided materials do not include independent confirmation from Level Infinite/Tencent, and details are based on information from a third-party security researcher.