On the 5th, Level Infinite issued an official apology regarding the tampering with PC launcher files and malware distribution for 'Goddess of Victory: Nikke', disclosing the detailed incident timeline and a security check guide.
In an official statement, the 'Goddess of Victory: Nikke' operations team stated, "It is entirely unacceptable that an official program launched to enjoy the game could instead threaten the safety of users," adding, "We feel deep responsibility as the publisher for failing to safely provide a service that users should be able to rely on without suspicion."
They continued, "This incident goes beyond merely causing inconvenience in playing the game; it has raised concerns about the safety of users' PCs and personal information and left fundamental questions about whether our service can be used with peace of mind. We deeply apologize for placing upon players the burden of checking for actual damage and the anxiety over potential secondary harm."
According to the investigation findings released alongside the apology, the incident began on September 27 at 10:59 AM when a domain (insightjs.com) used for certain game services was hijacked by a third party. Between 3:41 PM and 3:42 PM on the same day, four official CDN script files downloaded by the launcher were tampered with, and starting at 3:52 AM on October 30, malicious software was distributed to users' PCs via the altered scripts. Level Infinite confirmed the anomaly around 12:00 AM midnight on November 4, replaced three of the files with clean versions by 2:23 AM (first response stage), and completed updating the CDN cache for the remaining file by 12:09 PM the same day (second response stage). The mobile version was not affected by this incident.
Level Infinite urged all users who have run the Windows PC launcher at least once since September 27 at 3:41 PM to perform a security check. First, as of 8:00 AM on the 5th, a feature that automatically detects and removes malicious software upon running the official PC client was applied. Additionally, a manual check and removal guide was provided for users who wish to verify directly without running the launcher.
Furthermore, while preparing in-game compensation to convey their apology, Level Infinite plans to receive reports via the official customer support center and review responses if players experienced gameplay damage, external service account compromises, or secondary financial losses due to this incident. To prevent recurrence, the company plans to implement improvements such as strengthening security monitoring systems, establishing a launcher external resource integrity verification framework, and applying minimum privilege principles to launcher functions.
Below is the manual security check procedure for the Nikke PC launcher announced by the operations team.
Hello. This is the Goddess of Victory: Nikke operations team.
We deeply apologize for causing great anxiety and concern to all Commanders due to this PC launcher security incident.
Commanders who have executed the Windows PC launcher at least once since 15:41 on September 27 are requested to perform a security check and take the necessary measures.
Security checks and actions can be performed more conveniently using the security feature (ACE) provided by the official PC client.
For instructions on how to use this feature, please refer to the [PC Launcher Security Incident and Follow-up Measures Notice].
If you currently do not have the PC launcher installed or wish to proceed with the security check without using the launcher, please follow the steps below.
This security incident occurred within the PC launcher and did not affect the mobile version.
As such, Commanders who only use the mobile version do not need to perform a separate security check regarding this incident.
1. Preparation Before Starting the Security Check
Before starting the security check, please disconnect your network connection and completely close the NIKKE game, launcher, and Google Chrome browser.
Please also check the system tray at the bottom right of your PC screen to ensure no NIKKE icon remains running.
We recommend not running the NIKKE PC launcher again until the security check is complete.
2. Security Check
① Locating Launcher Log Files
Right-click the NIKKE icon on your desktop and select [Open file location] to open the NIKKE launcher installation folder.
In the installation folder, check for the file in the path below:
└ Launcher\intl_service\debug.log
└ Example: C:\NIKKE\Launcher\intl_service\debug.log
└ Example: C:\NIKKE_GOOGLE\Launcher\intl_service\debug.log
② Checking Log Content
1) Right-click the debug.log file and select [Open with] → [Notepad] to open the file.
2) Press Ctrl + F to search for the string below:
└ k2f_chan registered
If this string is found, malicious software may have been executed on your PC.
Please proceed with the malware removal instructions below.
Even if this string is not found, security risks cannot be entirely ruled out.
We recommend updating your antivirus software to the latest version and running a full scan.
3. Removing Confirmed Malware
The procedures below include tasks that modify files and the registry.
Please make sure to verify the specified paths and items before proceeding, and take care not to delete any other items.
① Deleting Abnormal Registry Entries
1) Press Win + R, type regedit, and select [OK].
2) Paste the path below into the address bar at the top of Registry Editor and press Enter:
└ HKEY_CURRENT_USER\Software\Classes\CLSID
3) In the above path, check for an item with the following name:
└ {E77CC89B-7401-4C04-8CED-149DB35ADD04}
4) If the item exists, right-click it and select [Delete].
Since items with the same name may exist in other paths, ensure you only delete the registry entry in the path specified above.
② Reboot PC
After deleting the registry entry, restart Windows.
③ Deleting Abnormal DLL Files
1) After restarting your PC, press Win + R, paste the path below, and press Enter:
└ %LOCALAPPDATA%\Google\Chrome\User Data\
2) In that path, check if there is a subfolder that meets both of the following conditions:
- Inside the PlatformExperienceHelper folder, there is a subfolder whose name consists solely of a 64-character hexadecimal string (digits 0–9 and lowercase letters a–f)
- Inside that subfolder, the file platform_experience_helper.dll is present
3) Only if both conditions above are met, delete the subfolder with the 64-character name.
Notes
- The PlatformExperienceHelper folder may contain legitimate Chrome files, so please take care not to delete the entire folder.
- If the PlatformExperienceHelper folder does not exist in the path above, abnormal DLL files have not been installed, so proceed to the next step.
④ Deleting Abnormal Downloaded Files
1) In the NIKKE launcher installation folder, open the folder in the path below:
└ Launcher\log\tinyget
2) Check if there is a file with a file size of 205,135 bytes (approx. 200 KB) and a filename matching a format similar to the following:
└ tinyget.<date>-<time>.log
3) Delete any file matching the above criteria. If no such file exists, proceed to the next step.
⑤ Deleting Launcher Local Cache
1) Press Win + R, paste the path below, and press Enter:
└ %APPDATA%\nikke_launcher
2) Delete the entire tbs_cache folder located in that path.
4. Account Security Check
We recommend performing the account protection measures below on another device unaffected by malware, or on the current PC only after completing its security check.
① Please change passwords for any accounts that have been used on that PC.
② If API keys or access tokens were used or stored on that PC, please revoke the existing keys and tokens and issue new ones.
5. System Security Scan
After updating Windows Security or another trusted antivirus program to the latest version, please run the scans below:
- Full antivirus scan
- Windows Security Offline scan (Microsoft Defender)
If any abnormal activity persists after completing all measures above, please contact customer support.
We sincerely apologize once again for placing the burden and inconvenience of conducting manual checks directly on Commanders.
Level Infinite Team
