Developer fixes Nikke PC launcher after malware attack

Hackers altered scripts in the official PC launcher for Goddess of Victory: Nikke on September 27, using the game’s software delivery path to push malware that could steal passwords, browser cookies and cryptocurrency wallet data. The game is not sold on Steam; its own Windows-based executable launcher from the official website distributes it. The malicious files came from publisher Tencent’s Level Infinite through its content delivery network, a system of servers that delivers files to users, and the developer deployed a client fix and update on November 4, 2026, at about 02:30 UTC+9. Level Infinite apologized on November 5 and said it prepared in-game compensation for all Commanders.

The publisher’s investigation traced the start to September 27 at 10:59 AM, when a third party hijacked the domain insightjs.com. The third party changed four official CDN script files downloaded by the launcher between 3:41 PM and 3:42 PM that day, and the modified scripts began delivering malware to PCs on October 30 at 3:52 AM. Level Infinite said it spotted the anomaly around 12:00 AM on November 4 and restored three files by 2:23 AM, then refreshed the CDN cache for the remaining file at 12:09 PM.

The company applied an automatic detection feature on November 5 starting at 8:00 AM. BleepingComputer reported that a researcher said Level Infinite posted clean versions of three affected JavaScript files on November 3, but a tampered copy of the fourth remained available at 22:26 GMT, suggesting one compromised script may have stayed reachable after the client update. Level Infinite has not publicly said how the attacker gained access or whether that access is fully contained.

The remote-access agent, software that lets an attacker control a computer from afar, could run commands, browse and download files, capture screenshots and collect browser credentials, developer credentials such as SSH keys and API tokens, and data from cryptocurrency wallet extensions. On Windows, it could install a DLL, a Windows file that holds code programs can use, under a Chrome user-data directory to keep running after the launcher closed. BleepingComputer verified an obfuscated loader in two tampered files that fetched code from insightjs.com and a fallback domain, a backup address used if the first is unreachable, and said the malware could target wallets including MetaMask, Phantom and Coinbase Wallet.

The malware did not hit every machine, and researchers cautioned that its listed capabilities do not prove the malware used every function or took credentials or cryptocurrency. Reports have not confirmed how many users the malware affected or whether the malware took any data. The mobile versions for Android and iOS were not affected, and no findings show direct compromise of the publisher’s main servers or player databases. People on Linux or Steam Deck who run the launcher through Proton, a compatibility layer that lets Windows games run on Linux, may be exposed, though the Windows-specific persistence mechanism, a method that keeps malware running after the launcher closes, applies only to Windows.

Anyone who launched the Windows PC launcher at least once after September 27 at 15:41 UTC+9 was told to perform a security check. The manual check involves opening the Nikke installation folder, opening Launcher\intl_service\debug.log in a text editor and searching for k2f_chan; its presence indicates the malware ran. Some users have reported finding that string in the log.

The publisher’s separate manual guide says to disconnect the network, close the game, launcher and Google Chrome, and check the system tray for a NIKKE icon before starting. It then instructs users to look for the string k2f_chan registered in the log file, delete a specific registry entry under HKEY_CURRENT_USER\Software\Classes\CLSID if it exists, and reboot Windows. Users should also check Chrome’s user-data folder for a PlatformExperienceHelper subfolder with a 64-character hexadecimal subfolder containing platform_experience_helper.dll, delete matching tinyget log files of 205,135 bytes, and remove the entire tbs_cache folder at %APPDATA%\nikke_launcher.

Even without the log string, the guide says risks cannot be fully ruled out, so it recommends updating antivirus software and running a full scan, including a Windows Security Offline scan. MotherSphere advised deleting the cache folder before opening the launcher again because it can still hold modified files, and warned that replacing the files does not reverse an infection that already happened. BleepingComputer said potentially affected players should run a full system scan with updated antivirus, and anyone who was compromised should reinstall Windows and change passwords and other sensitive credentials using a clean device.

Level Infinite recommends changing passwords for accounts used on the PC and revoking API keys or access tokens from another device. The company plans to handle reports of gameplay disruption or secondary damage to external accounts and financial losses through its official customer support center. To prevent repeats, it plans to strengthen security monitoring, build an integrity verification system for launcher resources, and apply minimum privilege rules for each launcher feature.

Officials have described the issue only as possible third-party tampering, and they have not said how many victims there were or whether the malware took any information out. The researcher’s report is an analysis rather than a management-confirmed fact, and researchers have not confirmed on whose terminals the functions ran.