NIKKE PC launcher hacked: what you should do

The NIKKE PC launcher spread malware: if you opened it after September 27, run the official scan and change passwords from a clean device.

FireGhost

November 6, 2026, 01:50 PM5 min read

Contents10 sections

The NIKKE PC launcher had four script files tampered with on September 27. The publisher says malware delivery began on October 30. If you opened the launcher after September 27, run a security check.

Goddess of Victory: NIKKE is a shooter RPG developed by Shift Up and published by Level Infinite. It runs on Windows, iOS and Android. Only the Windows launcher was affected.

What happened to the NIKKE PC launcher?

On November 4, the developers said the launcher's script files may have been tampered with by a third party. BleepingComputer reports a client update went out the same day at about 02:30 (UTC+9). On November 5 the publisher posted a formal apology and more detail.

According to the official notice, four script files downloaded by the launcher were changed on the official CDN. Malicious code was inserted. It could run whenever the launcher started.

Date	What happened
September 27	The insightjs.com domain was hijacked; four script files were altered the same day
October 30	Malware delivery began
November 4	Anomalies detected; three files replaced with clean ones, the remaining file fixed later
November 5	Scan and removal feature added to the official PC client

The timeline comes from the official notice as reported by Game*Spark.

NIKKE: Goddess of Victory official promotional image — Promotional image from the official NIKKE website (Source: Official NIKKE website)

What could the malware do?

The publisher shared few technical details. An independent researcher, MotherSphere, published a GitHub report with more. BleepingComputer examined parts of those claims.

Hidden code in the launcher downloaded extra code from remote servers.
A remote-access tool could run commands, browse files and take screenshots.
It could collect NIKKE account credentials and data stored in browsers.
An extra DLL contained code aimed at wallet extensions such as MetaMask and Phantom.

One caveat matters. It is unknown whether attackers actually deployed that DLL. It is also unknown whether any cryptocurrency was stolen.

Character illustration from the official NIKKE website — Character art from the official NIKKE website (Source: Official NIKKE website)

Who is at risk and what should you do?

If you opened the Windows launcher even once after 15:41 (UTC+9) on September 27, 2026, check your PC. Mobile-only players do not need to act.

Since November 5, the security feature in the official client has run a scan. Here are the steps:

Close every browser, including Chrome.
Launch the NIKKE PC client. If malware is found, a pop-up offers to delete related logs, DLL files and registry entries.
If nothing is found, no pop-up appears and the game starts as usual.
If you prefer to check without the launcher, the official guide has manual steps. They involve files and the registry, so verify each path carefully.
For a manual check, look in Launcher\intl_service\debug.log for the string “k2f_chan registered”. If it is there, the malicious code may have run.

After the scan, change your passwords from a clean device. Also replace any stored API keys and access tokens. The notice recommends updating your antivirus, then running a full scan and a Microsoft Defender offline scan. BleepingComputer advises anyone who finds an infection to reinstall Windows.

What measures has the publisher announced?

Level Infinite and Shift Up say the launcher version now distributed is safe. The company is still investigating how the tampering happened. To prevent a repeat, it lists three steps: stronger monitoring of the launcher and related systems, a check that verifies external resources the launcher loads, and minimal permissions for each function.

In-game compensation is being given to all players. Anyone who believes they suffered a loss can contact customer support. Shift Up CEO Kim Hyung Tae also apologized for the delay.

What does this mean for players?

The incident shows that game launchers are an attack surface too. Level Infinite reports more than 45 million downloads, yet one hijacked domain was enough. If you use a PC client, follow official notices and avoid reusing passwords.

For more on mobile and PC gacha news, read our Honkai: Nexus Anima closed beta post, our Honkai: Star Rail 4.7 guide and our Discord privacy settings article.

Frequently asked questions

Am I at risk if I only play NIKKE on mobile?

No. According to the official notice reported by Game*Spark, the problem affects the PC launcher. Mobile-only players do not need to take action.

Which launches should I check?

If you opened the Windows launcher even once after 15:41 (UTC+9) on September 27, 2026, you should run the security check.

What should I do if malware is found?

Accept the cleanup if the official tool offers it. Then change your passwords and any stored API keys from a clean device. If you suffered losses, contact in-game support.