On November 5, SHIFT UP and Level Infinite implemented a feature in the official PC client for *Goddess of Victory: NIKKE* that scans for and removes malicious programs distributed via a security incident involving the PC launcher.
On November 4, the developers announced that the PC launcher’s script files may have been tampered with by a third party. According to this latest announcement, players who have launched the Windows version of the PC launcher even once after 3:41 PM on September 27, 2026, are required to perform a security check and take the necessary measures.
Please note that this issue occurred with the PC launcher; players who only play the mobile version do not need to take any action.
Malware is scanned simply by launching the client. If detected, it is deleted immediately
This new feature has been available since 8:00 AM on November 5 through the security feature (ACE) built into the official PC client.
It’s simple to use: just close all running browsers (such as Chrome) before launching the PC client. If malicious software is detected, a pop-up will appear asking if you want to delete the related logs, DLL files, and registry entries stored on your PC; if you agree, all related data will be deleted.
If nothing is detected, no pop-up will appear, and the game will launch as usual. While some DLL files may remain if browsers aren’t completely closed, these files won’t be executed, so no additional risks are posed. Note that the pop-up interface has been simplified to ensure a swift response.
Look for “k2f_chan registered”… Manual checks are also possible without using the launcher
For users who haven’t yet installed the PC launcher or who wish to verify without using it, instructions for manual verification are also provided. Since the procedure involves manipulating files and the registry, the official team urges users to carefully verify the specified paths and entries and take care not to delete any other items. The general steps are as follows:
Preparation: Disconnect from the network and completely close the NIKKE game, the launcher, and Google Chrome. Also, check that the NIKKE icon is no longer in the system tray at the bottom right of your PC screen, and do not restart the launcher until you’re finished.
Check the Logs: Right-click the NIKKE icon on the desktop and select [Open File Location] to open the installation folder.Open “Launcher\intl_service\debug.log” in Notepad and use Ctrl+F to search for “k2f_chan registered.” If this string is found, there is a possibility that malicious software has been executed on your PC; proceed to the removal steps below.
Removing the malicious registry entry: Press Win+R, type “regedit” to open the Registry Editor, and delete “{E77CC89B-7401-4C04-8CED-149DB35ADD04}" located at "HKEY_CURRENT_USER\Software\Classes\CLSID". Since entries with the same name exist in other paths, be sure to delete only the one in this specific path
Restart the PC
Removing the Malicious DLL File: Press Win+R, type “%LOCALAPPDATA%\Google\Chrome\User Data\”, and press Enter to open the folder.Inside the “PlatformExperienceHelper” folder, there is a subfolder whose name consists solely of 64 hexadecimal characters (numbers 0–9 and lowercase letters a–f). Delete that subfolder only if it contains “platform_experience_helper.dll.”Do not delete the entire “PlatformExperienceHelper” folder, as it may contain legitimate Chrome files.
Deleting the malicious download file: In the “Launcher\log\tinyget” folder of the installation directory, delete any file with a name similar to “tinyget.
- Deleting the local cache: Press Win+R to open “%APPDATA%\nikke_launcher,” then delete the entire “tbs_cache” folder.
Even if the string is not found in the logs, it is stated that security risks cannot be completely ruled out. It is recommended that you update your antivirus software, such as Windows Security, to the latest version and then run a full scan and an offline scan with Microsoft Defender.
Support is also available for issues outside the game, such as password changes and API key reissuance
After removing the malicious program, you are also advised to take additional steps to protect your account.
In addition to changing the passwords for any accounts used on the affected PC, users are advised to discard any existing API keys or access tokens they have used or stored and request new ones. It is recommended that these tasks be performed on a different device not affected by the malicious program or on a PC that has undergone security verification.
Furthermore, if you experience any abnormalities with your account or suffer financial losses as a result of this incident, you can report them through in-game customer support. In a statement of apology released alongside this notice, the company mentioned that in-game compensation has been arranged but reiterated its apology, acknowledging that compensation alone cannot fully alleviate the anxiety and inconvenience caused.
It all began with a domain hijacking. The distribution of malicious software began on October 30.
The announcement also details the sequence of events leading to the incident.
September 27, 10:59 a.m.: The “insightjs.com” domain, used by part of the game service, was hijacked by a third party
September 27, 3:41 PM – 3:42 PM: Four script files from the official CDN downloaded by the launcher were tampered with, and malicious code connecting to a specific domain was inserted
October 30, 3:52 a.m.: Distribution of malicious software to users’ PCs began via these scripts
Around 12:00 AM on November 4: We detected anomalies in the script files and began our investigation and response
November 4, 2:04 a.m. – 2:23 a.m.: Three of the malicious script files were replaced, halting further distribution of the malicious software (Phase 1 Response)
November 4, 12:09 PM: Completed updating the CDN cache related to the remaining file and sequentially deployed the correct file to the relevant CDN nodes (Second Response)
The company reports that it is continuing to investigate the scope of the damage and is conducting a detailed review of the network security environment, including the CDN, to identify the route of the tampering.As measures to prevent recurrence, the company has cited strengthening the monitoring system for the PC launcher and related systems, establishing a mechanism to verify the integrity of external resources loaded by the launcher, and reviewing and limiting the permissions for each function to the absolute minimum.
