SHIFT UP and Level Infinite have released guidance on a security incident involving the PC version of the “Goddess of Victory: NIKKE” launcher, including instructions for using malware detection services and manual security checks.Players who launched the Windows PC launcher even once after 3:41 PM on September 27 have been advised to perform a check.
There is a possibility that malicious software capable of executing system commands and obtaining browser information—including cryptocurrency transaction data—was downloaded.
The security incident reportedly began on September 27 when a domain used by the service was compromised; at that time, a script leading to the distribution of malicious software was inserted into the launcher.The company stated that the malicious software was distributed via this script starting on October 30, and reported that countermeasures against the script had been completed as of November 4.
An analysis on GitHub by security engineer MotherSphere pointed out that the distributed malware was capable of executing programs and system commands, downloading files, collecting browser passwords and cookies, gathering data from cryptocurrency wallet extensions, and searching for developer credentials, API tokens, and other confidential information.Additionally, there are indications that the launcher script was activated as early as October 23, prior to the official announcement.
PCs Where the Launcher Was Run After September 27 Should Be Checked—Manual Offline Verification Procedure Also Released
The released malware detection service runs automatically when the PC client is launched; a pop-up will appear asking for confirmation to delete related items only if malware is detected. Since the service also accesses browser-related data, it is recommended to close all running browsers—such as Chrome—before launching the PC client.
In addition, manual verification procedures have been released for users who have already uninstalled the launcher and wish to perform a check while avoiding network connections. The procedures include checking the launcher’s folder and cache, as well as running a scan using Microsoft Defender or trusted antivirus software. The detailed verification procedures are as follows.
Commanders who have launched the Windows PC launcher even once after 3:41 PM on September 27 are requested to perform a security check and take the necessary measures.
Security checks and necessary measures can be performed more easily through the security feature (ACE) built into the official PC client.
For instructions on how to use this feature, please refer to the announcement titled “[Security Incident Regarding the PC Launcher and Future Measures].”
If you do not currently have the PC Launcher installed, or if you wish to perform the security check without using the launcher, please refer to the information below and carry out the verification.
This security incident occurred in the PC Launcher and does not affect the mobile version.
Therefore, Commanders who use only the mobile version do not need to perform any additional security checks regarding this matter.
1. Preparations Before Starting the Security Check
Before beginning the security check, please disconnect from the network and completely close the NIKKE game, the launcher, and the Google Chrome browser.
Please also verify that the NIKKE icon is no longer present in the system tray at the bottom right of your PC screen.
We recommend that you do not restart the NIKKE PC launcher until the security check is complete.
2. Security Check
① Locate the launcher’s log file
Right-click the NIKKE icon on your desktop, select [Open File Location], and open the folder where the NIKKE launcher is installed.
In the installation folder, check for the file located at the following path:
└ Launcher\intl_service\debug.log
└ Example: C:\NIKKE\Launcher\intl_service\debug.log
└ Example: C:\NIKKE_GOOGLE\Launcher\intl_service\debug.log
② Check the contents of the log
1) Right-click the debug.log file, select [Open with] → [Notepad] to open the file.
2) Press Ctrl + F and search for the following string:
└ k2f_chan registered
If you find this string, it is possible that malicious software is running on your PC.
Please follow the steps below to remove the malicious program and take further action.
Even if this string is not found, the security risk cannot be completely ruled out.
We recommend updating your antivirus software to the latest version and running a full scan.
3. Removing Confirmed Malicious Programs
The following procedure involves changes to files and the registry.
Be sure to verify the specified paths and entries before proceeding, and take care not to delete any other items.
① Delete the malicious registry entries
1) Press the Win + R keys, type “regedit,” and select [OK].
2) Paste the following path into the address bar at the top of the Registry Editor and press the Enter key.
└ HKEY_CURRENT_USER\Software\Classes\CLSID
3) In the path above, locate the entry with the following name:
└ {E77CC89B-7401-4C04-8CED-149DB35ADD04}
4) If the entry exists, right-click it and select [Delete].
Since entries with the same name exist in other paths as well, be sure to delete only the registry entry located at the path specified above.
② Restart your PC
After deleting the registry entry, restart Windows.
③ Delete the malicious DLL file
1) After restarting your PC, press the Win + R keys, paste the following path, and press Enter.
└ %LOCALAPPDATA%\Google\Chrome\User Data\
2) Check this path to see if there is a subfolder that meets both of the following conditions:
- There must be a subfolder within the PlatformExperienceHelper folder whose name consists solely of 64 hexadecimal characters (numbers 0–9 and lowercase letters a–f).
- That subfolder must contain a file named platform_experience_helper.dll
3) Only if both of the above conditions are met, delete the subfolder whose name consists of 64 hexadecimal characters.
Important Notes
- Do not delete the entire PlatformExperienceHelper folder, as it may contain legitimate Chrome files.
- If the PlatformExperienceHelper folder is not present at the path above, the malicious DLL file has not been installed. Please proceed to the next step.
④ Delete the malicious download file
1) In the folder where the NIKKE Launcher is installed, open the folder located at the following path:
└ Launcher\log\tinyget
2) Check for a file with a size of 205,135 bytes (approximately 200 KB) and a filename similar to the following format:
└ tinyget.
3) Delete any files that meet the above criteria. If no such files are found, proceed to the next step.
⑤ Clear the launcher’s local cache
1) Press the Win + R keys, paste the following path, and press Enter.
└ %APPDATA%\nikke_launcher
2) Delete the entire tbs_cache folder located at this path.
4. Verify Account Security
We recommend performing the following account security measures after verifying the security of another device that has not been affected by malicious software, or after completing a security check on the PC you are currently using.
① Change the passwords for any accounts you have used on this PC.
② If you have used or stored API keys or access tokens on this PC, please revoke the existing keys and tokens and generate new ones.
5. System Security Scan
Update Windows Security or other trusted antivirus software to the latest version, and then perform the following scans:
- Full scan with antivirus software
- Offline scan using Windows Security (Microsoft Defender)
If the issue persists even after completing all of the above steps, please contact Customer Support.
We would like to once again sincerely apologize for the burden and inconvenience caused to all Commanders by requiring you to perform these verification steps on your own.
The Level Infinite Team
Plans to take necessary measures, including addressing out-of-game account issues and financial losses
Level Infinite takes this incident very seriously and is implementing necessary improvements, including a thorough review of its overall security management system to prevent recurrence. The company also states that it will take necessary measures, including addressing issues related to accounts outside the game and financial losses, and urges players to contact official customer support if any abnormalities occur.
We strongly recommend that players who have launched the PC version of *Goddess of Victory: NIKKE* since September 27 check their accounts.
