NIKKE malware: how to check if the PC launcher infected you

The detail that tells you how this worked is a single domain name. Level Infinite's own timeline says the attack started when insightjs.com, an open-source domain "used by certain game services," was hijacked at 10:59 Korean time on September 27. Less than five hours later the launcher's script files had been altered through it, and from October 30 those scripts were handing malicious programs to players' PCs. Level Infinite says it only detected the problem around midnight Korean time on November 4.

What happened to the NIKKE PC launcher?

A third party tampered with the script files the NIKKE Windows PC launcher loads, which let malicious programs run on players' PCs when the launcher opened, Level Infinite says in its security incident notice. The publisher writes that "your PCs and account information may have been exposed to security risks" and that it is still investigating the extent of the damage, including a review of its CDN to find out how the files were compromised.

Goddess of Victory: NIKKE is SHIFT UP's sci-fi shooter RPG on PC, iOS and Android, and the problem sits only in the PC launcher. The publisher's manual check guide says plainly that the incident "did not affect the mobile version of the game," so players who only use their phone don't need to do anything.

Level Infinite hasn't described what the malicious program could do. The most detailed outside account is a technical write-up published on GitHub on November 3 and summarised the same day by INVEN Global Its author says the agent could run commands, browse and download files, take screenshots, and pull saved browser passwords, Windows credentials, SSH keys, API tokens and data from 28 browser crypto wallets, and that it only ran on some launches. None of that has been confirmed by Level Infinite.

When was the launcher compromised? The full timeline

The window runs from September 27 to November 4, 2026, according to the timeline in Level Infinite's notice. All times below are the publisher's, in Korean time (UTC+9); the UTC column is our conversion.

https://x.com/NIKKE_en/status/2117817602659770434

How do I check if my PC was infected?

Open the current official PC client after closing every browser, including Chrome: from November 5 at 08:00 (UTC+9), which is 3 p.m. PT on November 4 by our conversion, the client scans for the malicious programs from this incident during launch, Level Infinite says. If it finds them, a pop-up asks for permission to remove the related logs, DLL files and registry entries. If it finds nothing, the game starts normally with no extra pop-up. Level Infinite adds that if a browser was left open, some DLL files may stay on the PC, but "these files will no longer be executable."

If you've uninstalled the launcher or don't want to open it, the manual guide gives a log test first. Disconnect the PC from the network, close NIKKE, the launcher and Chrome, and make sure no NIKKE icon is left in the system tray. Then:

1. Open Launcher\intl_service\debug.log inside your NIKKE install folder (for example C:\NIKKE\Launcher\intl_service\debug.log) in Notepad.
2. Press Ctrl + F and search for k2f_chan registered.

If that string appears, "there is a possibility that a malicious program was executed on your PC." If it doesn't, Level Infinite says that "does not completely rule out potential security risks" and recommends updating your antivirus and running a full system scan.

How do I remove the NIKKE malware manually?

The manual guide lists four removal steps and warns that they touch files and the registry, so delete only the exact items it names:

1. In Registry Editor, go to HKEY_CURRENT_USER\Software\Classes\CLSID and delete the entry named {E77CC89B-7401-4C04-8CED-149DB35ADD04} if it's there (only at that path), then restart Windows.
2. In %LOCALAPPDATA%\Google\Chrome\User Data\, look inside the PlatformExperienceHelper folder for a subfolder whose name is exactly 64 hexadecimal characters and which contains platform_experience_helper.dll. Delete that subfolder only if both are true; the folder itself can hold legitimate Chrome files.
3. In the launcher's Launcher\log\tinyget folder, delete any file that is exactly 205,135 bytes and whose name is tinyget. followed by a date and time, ending in .log.
4. In %APPDATA%\nikke_launcher, delete the whole tbs_cache folder.

After that, the guide asks for a full antivirus scan and a Microsoft Defender Offline Scan, both with up-to-date definitions.

What should I do about passwords and accounts?

Change the password of every account you used on the affected PC, and revoke and regenerate any API keys or access tokens you used or stored on it, Level Infinite says. It recommends doing this from a different device that wasn't affected, or after the PC has passed the security check. Anyone who thinks they lost something, including access to outside accounts or money, is asked to contact NIKKE's in-game Customer Support, which the publisher says will review each report.

The GitHub write-up quoted by INVEN Global goes further: it tells infected players to log out of every session and move crypto funds to a new wallet. That advice is the researcher's, not Level Infinite's.

Is NIKKE safe to play now?

Level Infinite says it is. In its apology the publisher writes that after additional inspections it can "confirm that the currently distributed version of the launcher is safe to use." Its incident notice also promises integrity checks on outside resources the launcher loads and tighter monitoring for file changes.

Every player is getting in-game compensation, the apology adds, though the notice doesn't say what it is. SHIFT UP, which also made Stellar Blade, develops NIKKE; the statements so far are signed by Level Infinite and the NIKKE operations team.

What we don't know yet

• How many PCs actually received the malicious program. Level Infinite says it is still investigating the extent of the damage.
• What the in-game compensation contains and when it arrives.
• Whether NIKKE's PC launcher on Linux or Steam Deck through Proton was affected. The GitHub author warned it could be; Level Infinite's notices only mention Windows.

Sources

• Level Infinite: PC launcher security incident
• Level Infinite: Manual security check
• Level Infinite: Apology
• NIKKE on X: launcher anomaly notice
• INVEN Global: first report