NIKKE’s publisher is asking Windows players to check their computers after tampering with the game’s PC launcher scripts. Its updated security instructions cover players who launched the PC version from September 27 at 15:41 UTC+9. The publisher says mobile versions are unaffected, so mobile-only players do not need to perform these checks.
The advice follows a client fix issued around November 4 at 02:30 UTC+9, as reported by BleepingComputer. Restoring a launcher’s download source and assessing a computer that already ran malicious code are separate jobs. A corrected update does not establish what happened during earlier launches.
What the launcher could deliver
Independent researcher MotherSphere’s analysis describes four JavaScript files on Level Infinite’s content delivery network modified to fetch attacker-controlled code. The researcher links that loader to a LuaJIT remote-control agent referred to as K2F, with capabilities including command execution, file access, screenshots and credential collection.
The analysis also describes a Windows DLL component that could persist after the launcher closed and target browser information. Its availability does not establish that the component was installed on every exposed computer. BleepingComputer reported that it independently examined two modified scripts and found the obfuscated loader.
MotherSphere’s updated account says all four files were clean on the CDN servers checked on November 4 at 11:20 GMT. Cached launcher files could still retain modified copies. The initial route used to alter the CDN files remains unresolved in the researcher’s account.
Check before treating the machine as recovered
The publisher’s instructions start with disconnecting the network and closing the game, launcher and Chrome, including background instances. Players are told not to relaunch until their checks are complete. The manual procedure covers launcher logs, specific Windows persistence artifacts and cached files; it should be followed carefully rather than replacing it with blanket deletion of normal Chrome folders.
One check searches Launcher\intl_service\debug.log for k2f_chan registered. The publisher warns that a missing entry does not completely rule out risk. Finding or failing to find a single indicator is therefore not a complete incident assessment. Where evidence matters, preserve relevant logs and cache data before cleanup removes them.
The official notice also calls for full malware scans and Microsoft Defender Offline checks, and changing passwords, API keys and access tokens from another clean device. Players should use the publisher’s current checklist for the exact file locations and cleanup sequence. A launcher repair cannot revoke secrets that may already have been copied.
