Players found it before the studio said anything
A security researcher's public report on GitHub, picked up by Inven Global in its first coverage, described three official JavaScript files on Level Infinite's CDN that the Windows launcher for Goddess of Victory: NIKKE loads each time it opens. According to that report, the files had been altered to download and run a remote-access tool. Siliconera and CyberInsider both reported that the launcher was tampered with by a third party.
Inven Global also noted that the first articles appeared before the publisher had commented. That gap is part of the story: players were left guessing for a while about whether to launch the game at all.
What the tool could reportedly do
CyberInsider's write-up says the payload could run commands, take screenshots, pull files and grab saved logins and session cookies. The exact start date differs between reports. Some point to the last week of October, while Level Infinite's own notice, as relayed by Inven Global, gives a different starting point. For that reason the safest reading is "late October onward", and anyone affected should follow the publisher's notice rather than a press timeline.
The publisher's notice describes a manual check for a specific entry in a launcher debug log, with the caveat that a missing entry proves nothing if the game was reinstalled or logs were cleared. It also advises changing passwords from a clean device and enabling two-factor authentication.
What the companies did next
Shift Up and Level Infinite say client fixes went out in the early hours of November 4 (Korean time), and Inven Global reports that Shift Up's CEO apologized publicly. According to the same outlet, a feature that detects and deletes the malicious program when the official client runs was applied on November 5, in-game compensation is being prepared, and reports of account or financial damage will be reviewed through customer support. The mobile version is reported as unaffected, and Tencent told Inven Global it has seen no sign that other games were hit.
Why a small team should care
Most indie teams do not run a custom launcher. But plenty load something from outside the build: a web view for patch notes, an analytics snippet, a store SDK, an update manifest. Anything your game fetches and executes at runtime is part of your attack surface, and it usually sits outside your normal test pass.
A few cheap habits help. List every remote resource a build touches at startup. Pin or hash scripts where you can. Keep two-factor on the accounts that control your CDN, storefront and build servers. And rehearse your announcement: who writes it, where it goes, and how fast, because the first hours of silence are what players remember.
None of this makes headlines until it fails. A release checklist that includes "what does this build download, and from where?" is the kind of boring QA that IndieBug likes to see in a studio's process before launch day, not after.