NIKKE PC Launcher Malware Attack: How to Scan and Remove It on Windows

Inven Global published three versions of the same report with slightly different headlines, and Enduins covered the same apology and timeline. They all describe one incident. Here is what is known, where independent researchers disagree with the official account, and what Windows users should do.

What Level Infinite says happened​

The NIKKE operations team said a third party altered launcher files, which could let malicious programs run when the launcher started. The publisher said players' PCs and account information may have been exposed and that it is still investigating the damage. The apology was blunt. The team said an official program should never threaten the users who run it, and that it felt responsible for failing to deliver a service players could use without hesitation.

The official timeline is below. Times are UTC+9, as Level Infinite published them, with UTC added where it helps:

Game Over's write-up uses the same UTC conversions and says the official PC client gained a scan that finds and removes the malware at Nov 5, 08:00 (Nov 4, 23:00 UTC). Level Infinite also says the mobile version was not affected.

Section summary: Attackers changed four launcher scripts on the publisher's CDN. Level Infinite says malware went out between October 30 and November 4, and only the Windows PC launcher was involved.

What the payload actually did​

The official notice says little about what the malware was capable of. Other reporting fills that in. Windows Report, citing BleepingComputer, says the malware could execute remote commands, browse local files, capture screenshots, and collect browser-stored credentials. Inven Global published a separate technical explainer on how it was delivered. Short commands were inserted into legitimate files so that when the launcher executed them, it would simultaneously load a script from an external address (insightjs.com) set up by the attacker. That script then leverages the launcher's built-in download feature to fetch a file named 'insight.bundle' from the attacker's server. This file is saved inside the launcher folder with a .log extension to look like a log file, executed, and immediately deleted.

That explains why the manual guide below checks a log folder for one specific file size. The attackers disguised the payload as a log file. An open-source detection kit on GitHub says the code uses the launcher's own signed downloader to fetch a ~205 KB payload (insight.bundle) and runs it in memory as a Lua agent. That matches the 205,135-byte file Level Infinite tells users to look for. A separate read-only checker project says the agent adds a DLL and registry key on Windows so that Google Chrome loads it, which explains why the cleanup involves Chrome's user-data folder.

Where independent researchers disagree with the official account​

There are two points where the official account and community research don't match.

1. When distribution started. Level Infinite gives October 30 as the start of malware distribution. Community researchers report earlier infections. The GitHub detection kit's timeline lists Oct 23 as the earliest stealer install seen on a player's PC (an earlier version of the stealer). The researchers also report that installs were intermittent: it came on some launches, not others (3 of 8 on one PC). If those reports hold up, a clean result after one launch doesn't prove the PC was never infected. This is also why Level Infinite's precautionary scope starts on September 27 rather than October 30.

2. "Hijacked" or newly registered? Level Infinite describes insightjs.com as an open-source domain that was hijacked. Inven Global's technical piece reports that the insightjs.com domain used for the attacker's server was registered at 1:59 GMT, and nearly five hours later, at 6:41 GMT, official CDN files began to be altered. A community indicator log says the same: insightjs.com was registered 2026-09-27 01:59 GMT through PDR Ltd. A domain registered the same morning the CDN files were changed suggests attacker-controlled infrastructure set up for the attack. That is different from a legitimate long-running dependency being taken over. Level Infinite hasn't explained how the attacker got write access to its CDN files, and that is probably the more important question.

Neither point disproves the publisher's account. Its timeline may describe the confirmed distribution window rather than every early test. Users should still give more weight to the wider exposure window.

Section summary: Community researchers report infections from October 23, with payloads delivered on only some launches. Base your risk decision on the full September 27 window, not just October 30.

Who should check​

Level Infinite asks anyone who launched the Windows PC launcher at least once after September 27 at 15:41 (UTC+9) to run a security check. This is a precautionary scope. It doesn't mean every such PC is infected. Players who used only the mobile version don't need to do anything for this incident.

There is one group the official notice doesn't mention. The GitHub detection kit warns that exposure also includes the PC launcher on Linux or Steam Deck (through Proton). If you ran the Windows launcher through Proton, you should check too.

Option 1: The built-in ACE scan​

From November 5 at 08:00 (UTC+9), the official PC client includes an ACE security feature that scans for malicious programs linked to the incident and removes them. Before opening the client, close every browser, including Chrome. If the scan finds something, it asks for permission to delete the related logs, DLL files and registry entries. Level Infinite says that if a browser was still open, some DLL files may remain. They would no longer be executable and wouldn't pose an additional risk, but they would still be on disk.

According to Windows Report, the publisher says the currently distributed launcher is safe following its fixes and additional inspections. Some players won't want to open the program that infected them in order to clean it up. For them, there's a manual route.

Option 2: Manual check and removal, step by step​

This procedure comes from Level Infinite's operations team, as published by Inven Global. It involves deleting files and registry entries, so check every path exactly and delete nothing else.

Preparation

1. Disconnect from the network.
2. Fully close NIKKE, the launcher and Google Chrome.
3. Check the system tray to make sure no NIKKE icon is still running.
4. Don't reopen the launcher until the check is finished.

Check the log

1. Right-click the NIKKE desktop icon and select Open file location.
2. Go to Launcher\intl_service\debug.log. Example paths are C:\NIKKE\Launcher\intl_service\debug.log and C:\NIKKE_GOOGLE\Launcher\intl_service\debug.log.
3. Open the file in Notepad, press Ctrl + F and search for k2f_chan registered.

If the string is there, a malicious program may have run, so continue with removal. If it isn't, the risk still can't be ruled out, so update your antivirus and run a full scan.

Remove the malware

1. Press Win + R, type regedit and open HKEY_CURRENT_USER\Software\Classes\CLSID. If {E77CC89B-7401-4C04-8CED-149DB35ADD04} exists at that exact path, delete it. Entries with the same name may exist elsewhere. Leave those alone.
2. Restart Windows.
3. Open %LOCALAPPDATA%\Google\Chrome\User Data\. Look inside PlatformExperienceHelper for a subfolder whose name is exactly 64 lowercase hexadecimal characters (0–9, a–f) and that contains platform_experience_helper.dll. If both conditions are met, delete only that subfolder. Don't delete the whole PlatformExperienceHelper folder, because it may contain legitimate Chrome files. If the folder doesn't exist, the DLL wasn't installed.
4. In the launcher folder, open Launcher\log\tinyget. Delete any file that is exactly 205,135 bytes and named like tinyget.<date>-<time>.log.
5. Open %APPDATA%\nikke_launcher and delete the entire tbs_cache folder.

One detail to watch: the C:\NIKKE_GOOGLE example shows that more than one launcher build exists. A community incident log notes that one variant installs to C:\NIKKE_GOOGLE, runs Launcher\nikke_launcher_google.exe and keeps its data in %APPDATA%\nikke_launcher_google. That is a community report, not part of the official guide. Still, if your install is the Google variant and %APPDATA%\nikke_launcher doesn't exist, look for the matching folder instead of assuming you're clean.

After cleanup: credentials, tokens and a Defender offline scan​

Removing the malware doesn't undo what it may already have taken. Level Infinite recommends the following:

• Change the passwords for every account used on the affected PC. Do this from a different, clean device, or after the PC has been checked.
• Revoke and reissue any API keys or access tokens that were used or stored on the machine. Developers who keep cloud credentials, GitHub tokens or similar secrets on a gaming PC should take this seriously.
• Update Windows Security (or another trusted antivirus) and run both a full scan and a Microsoft Defender Offline scan.

On current Windows 10 and 11 builds, the offline scan is under Windows Security > Virus & threat protection > Scan options. Choose the Microsoft Defender Antivirus (offline scan) option and run it. The PC restarts and scans before Windows fully loads, so save your work first. This path comes from general Windows knowledge, not from Level Infinite's guide.

Researchers also suggest blocking the attacker's infrastructure. This advice isn't in the official notice. Inven Global's explainer recommends that users block three domains (insightjs.com, analytics.insightjs.com, insightjs.org) via your hosts file, router, or firewall, and block IP address 89.127.233.127 via router or firewall. The hosts file is at C:\Windows\System32\drivers\etc\hosts, and you need to open Notepad as administrator to edit it. Note that insightjs.org has changed hands: it now serves a multilingual "NIKKE PC Launcher Security Alert" page run by a third party. Blocking it does no harm. Community tracking also reports that on Nov 5, 02:05 GMT the registrar suspended insightjs.com (clientHold); its DNS records are gone.

If tools show signs of real compromise, some reporting goes further than the publisher. Kapten Tekno argues that if your PC is confirmed to have a severe infection, performing a clean Windows installation is the safest option. For a machine that ran a remote-access agent, reinstalling is the most thorough option.

Secondary damage: reports, not reimbursement (yet)​

According to Inven Global, Level Infinite will review and respond to reports sent through official customer support from players who suffered gameplay damage, had external-service accounts compromised, or lost money as a result. Enduins describes it as a dedicated reporting channel through its customer support center. That quote is attributed to Enduins' own reporting rather than the GitHub release page; the tool returned it with the wrong index, so the wording is the reporter's and not Level Infinite's.

Be clear about what has been promised. Level Infinite will review reports. It hasn't announced a reimbursement program or said what happens to individual claims. Players who suspect losses should document everything now: bank or wallet transactions, login alerts, and when they ran the launcher.

All players will receive in-game compensation. The publisher itself admitted that in-game items can't make up for the worry caused.

The fix list and the bigger lesson​

Level Infinite says it will:

• Review security management for the launcher and related data
• Strengthen monitoring for unauthorized file changes
• Build integrity verification for external resources the launcher loads
• Reduce launcher features' permissions to the minimum necessary

No timelines or technical details were given.

From an industry perspective (our analysis, not the publisher's), this was a supply-chain attack. Many modern launchers are essentially web apps that load JavaScript from a CDN at runtime. If one of those scripts is changed, every user who opens the launcher runs the attacker's code. The integrity verification Level Infinite plans is the standard defense: sign or hash every remote resource and refuse to load anything that doesn't match. The same principle is behind Subresource Integrity on the web and code signing on Windows. The least-privilege change matters too. Researchers say the payload abused the launcher's own signed downloader, so a launcher that can download and run arbitrary files on instruction from any script it loads is dangerous by design.

The detection gap is the uncomfortable part. Level Infinite's own timeline shows the tampered files sat on its CDN from September 27 until anomalies were caught on November 4, more than five weeks. File-integrity monitoring should cut that time sharply, but only if it is actually built and deployed.

Bottom line​

• Affected: Users of the Windows NIKKE PC launcher (including, per researchers, Proton/Steam Deck) who launched it after Sept. 27, 15:41 UTC+9. Mobile-only players are not affected.
• Do now: Run the ACE scan or follow the manual cleanup, then run a Defender Offline scan.
• Then: Rotate passwords and API tokens from a clean device, and block the attacker's domains and IP.
• If you lost something: Document it and report it to Level Infinite customer support. Reimbursement hasn't been promised.
• Keep in mind: Researchers report infections a week earlier than the official October 30 start date, and payloads were delivered on only some launches. A single clean log check doesn't fully clear a PC.