NIKKE PC Launcher Malware: How to Check Your PC

Updated 4 November 2026. Checked against MotherSphere's public technical report (last updated ~07:30 IST today), Yonhap's Level Infinite reply, and the live CDN status in that report. I'll update this post when Level Infinite or Shift Up publish an official fix notice.

Short answer: if you opened the Goddess of Victory: NIKKE PC launcher any time from late October through early November, treat that PC as possibly infected. Attackers altered four official JavaScript files on Level Infinite's CDN. Opening the launcher could pull a remote-control agent that stays active while the launcher is open, and on Windows it can leave a Chrome-loaded DLL behind so it keeps running after you quit.

I'm writing this up because a lot of players will see Korean or Discord panic posts and not know which log line to search for. Level Infinite told Yonhap News Agency it is "checking internally." It has not published a player-facing fix notice yet, so do not open the launcher until it does. Here's the check-and-clean path I'd follow.

Jump to:

• What happened
• Step 1: Stop opening the launcher
• Step 2: Search debug.log for k2f_chan
• Step 3: Clear the launcher cache
• Step 4: Remove Windows persistence
• Step 5: Rotate passwords, sessions and wallets
• Step 6: Linux and Steam Deck (Proton)
• Quick IoC table
• FAQ

What happened

NIKKE is Shift Up's free-to-play shooter. On PC it runs through a Level Infinite (Tencent) launcher, not Steam. That launcher loads scripts from Level Infinite's CDN on playerinfinite.com (Tencent COS).

According to the public report by MotherSphere on GitHub Gist (updated through early morning IST on 4 November), four of those official files were modified on 27 September 2026:

• aegis-fix.min.js
• vue-bucket.min.js
• images.7fec4c32.js
• FeedList.feb647c9.js

Each modified copy quietly loaded attacker code from insightjs.com. From 23 October at the latest, some launches then downloaded a remote agent from analytics.insightjs.com. While the launcher stayed open, the operator could run commands, read files, take screenshots, pull browser passwords and cookies, scan developer credential paths, and copy Chrome crypto-wallet extension data.

On Windows the agent can also register a DLL under the current user so Chrome loads it. That path does not need Chrome to be installed first, and the DLL can keep collecting passwords and wallet seed phrases after you close the game. Microsoft Defender Offline missed it on at least one checked machine.

Yonhap reported the same outline on 4 November and quoted Level Infinite as saying it is checking internally. MotherSphere's Nov 3 evening update said three of the four files were replaced at the origin that afternoon (GMT), the attacker server stopped answering, and one file (FeedList.feb647c9.js) was still coming from two stale CDN nodes hours later. None of that cleans machines that already ran the agent, and the launcher cache can still hold the old scripts. So the practical rule is still: leave the launcher closed until Level Infinite confirms a fix, then clear the cache before you open it again.

Step 1: Stop opening the launcher

Close NIKKE and the PC launcher completely, including the tray icon. If you can, disconnect that PC from the internet while you check. Do not open the launcher "just to see if it still works" until Level Infinite says the CDN is clean. Every open while a modified script is still cached is another chance for the agent to start.

Block these domains and IPs in your hosts file, router or firewall so the current command server cannot be reached:

insightjs.com
analytics.insightjs.com
insightjs.org
89.127.233.127
89.126.250.172

That only stops the servers listed in the public report. How the attacker got write access to the CDN is still unknown, so a new domain is possible later.

Step 2: Search debug.log for k2f_chan

Open your NIKKE install folder, then open Launcher\intl_service\debug.log in a text editor. Search for k2f_chan.

If you find k2f_chan registered, the agent ran on that machine. Treat yourself as infected even if the next lines are missing. An infected stretch of log looks like this:

"lua downloaded to log\tinyget\tinyget.<timestamp>.log"
"k2f_chan registered"
"adopted <uuid>"
"agent started as <your computer name>"

Early runs used log\tinyget\k2f.lua instead of the tinyget.*.log name. The launcher appends to debug.log, so older launches are still there unless you deleted or reinstalled the NIKKE folder.

Two extra checks help when the install folder is gone:

• In %APPDATA%\nikke_launcher\tbs_cache\Local Storage\leveldb\, search for k2f.agent.
• In DNS or router logs, a lookup of insightjs.com means the loader ran; analytics.insightjs.com usually means the agent stage was reached. A missing DNS hit does not clear you if the PC used another DNS server.

Do not treat FETCH_LIST suc success as a bad sign. That line comes from the normal FeedList module on clean launches too.

Step 3: Clear the launcher cache

Whether or not k2f_chan showed up, delete the launcher cache before you ever open NIKKE again:

%APPDATA%\nikke_launcher\tbs_cache

On Proton / Steam Deck that folder sits inside the Wine prefix. The cache can still hold the Sep 27 modified scripts even after the origin CDN is cleaned. MotherSphere also lists fixed Code Cache file names for the four loaders (dd65fa4d61079e7e_0, ce2fd3f1007a9fe9_0, 1416c638b3830103_0, fd520c7c0f65c2d7_0) under tbs_cache\Code Cache\js\; deleting the whole tbs_cache folder removes those.

Step 4: Remove Windows persistence

Skip this step on Linux/Steam Deck. On Windows, do it if Step 2 found k2f_chan, or if you just want to be sure.

1. Delete the user registry key HKCU\Software\Classes\CLSID\{E77CC89B-7401-4C04-8CED-149DB35ADD04} if it exists. The same CLSID under HKLM is normal Windows Parental Controls (wpc.dll). Leave the HKLM copy alone. Only the HKCU copy is malicious. Delete it even when the default value is empty; that is what the agent's own uninstall leaves behind.
2. Restart Windows. The DLL stays locked while it is loaded, even with every Chrome window closed.
3. Open %LOCALAPPDATA%\Google\Chrome\User Data\PlatformExperienceHelper\. Delete any subfolder whose name is a 64-character hex string and that holds platform_experience_helper.dll. Do not delete the whole PlatformExperienceHelper folder. Chrome creates that folder itself for its own helper exe and an empty LoadFeatures file.

A clean antivirus scan is not proof. Defender Offline missed the DLL on one reported machine. If the agent had time to run exec, a full Windows reinstall is the safest option, because the operator could install anything else under your user account.

Step 5: Rotate passwords, sessions and wallets

Do this from a different, clean device. The agent can steal browser cookies, so changing a password on the infected PC is not enough while sessions are still live.

1. Change the NIKKE / Level Infinite password first, then email, Discord, banking and every password the browser had saved. Turn on two-factor authentication where it is off.
2. Sign out of every active session you care about: Discord, Google, Steam, GitHub and similar. Cookie theft works without the password.
3. Revoke and recreate API tokens, SSH keys and developer credentials (GitHub, npm, AWS, OpenAI, Anthropic and the rest). The agent scans hundreds of known credential paths. If you have done a full rotation before, my post on rotating API keys after a breach is the order I still use.
4. Move crypto funds to a brand-new wallet with a new seed phrase. The payload had a dedicated wallet_files command for Chrome wallet extensions.

If you also keep a self-hosted Bitcoin stack, the recent BTCPay hot-wallet check is worth a pass this week for the same "assume the worst, rotate, rebuild" mindset.

Step 6: Linux and Steam Deck (Proton)

Proton does not isolate you from this. The Windows Chrome DLL does not apply, but Wine maps your Linux home and often the whole filesystem as drive letters. With exec, ls, cat and download, the operator can read anything your Linux user can read: ~/.ssh, browser profiles, shell configs with API keys, password stores and documents. Treat every secret in that home folder and in the environment as exposed, clear the launcher cache inside the prefix, and rotate from a clean machine the same way as on Windows.

Quick IoC table

Primary sources for the checks above are MotherSphere's gist (NIKKE PC launcher compromise) and Yonhap's 4 November report quoting Level Infinite. I'll refresh this page when either Level Infinite or Shift Up posts a confirmed fix for players. Related reading if you are mid-rotation: the Claude Code extension backdoor cleanup and the Trezor reseller implant warning.

More guides on Security checkers & patch guides:

• Claude Code Extension Backdoor: How to Check and Clean Up
• Claude Code's Don't Ask Again File Leaks Secrets
• Linux TCP Flaw CVE-2026-98432: Check and Patch Now
• APT CVE-2026-109518: Check and Patch Now
• BTCPay Server Hot Wallets Drained: Check and Update Now
• Discord Messages in Google: What's Public, How to Hide

FAQ

I only play NIKKE on my phone. Am I affected?

This incident is about the PC launcher and the CDN scripts it loads. The mobile apps are a different client. Still change your Level Infinite / NIKKE password if you ever used the same account on a PC that opened the launcher in the risk window.

The CDN files were cleaned on Nov 3. Can I launch now?

Not yet, in my view. Level Infinite has not published a player-facing all-clear, one file was still served dirty from some CDN nodes hours after the origin swap, and your local tbs_cache may still hold the old scripts. Wait for an official notice, then clear the cache before you open the launcher.

I never installed Chrome. Am I safe from the DLL?

No. The report says the Chrome DLL can be installed without Chrome present. Check the HKCU CLSID and the PlatformExperienceHelper path anyway if k2f_chan is in your log.

Antivirus said I was clean. Does that clear me?

No. MotherSphere notes Microsoft Defender Offline missed the DLL on a checked machine. Trust the log string and the registry/path checks over a green AV badge.

Does Steam Deck or Linux Proton protect me?

No. Proton still runs the Windows launcher. The Chrome DLL persistence is a Windows-only piece, but remote file read and command execution can reach your Linux home through Wine drive mappings. Clear the cache in the prefix and rotate secrets.

Who confirmed this officially?

As of this morning IST, Level Infinite has only told Yonhap it is checking internally. The detailed IoCs and remediation steps come from MotherSphere's public technical report, which other players have been cross-checking in the gist comments. Treat the situation as real and unfinished until Level Infinite posts its own advisory.