On November 5, Level Infinite issued an official apology regarding the tampering with 'Goddess of Victory: Nikke' PC launcher files and malware distribution, while releasing details of the incident and a security check guide.
In an official apology statement, the 'Goddess of Victory: Nikke' operations team stated, "It should never happen that an official program executed to enjoy the game could instead threaten user safety," adding, "As operators, we feel a deep sense of responsibility for failing to safely deliver a service that players should be able to use without hesitation."
They continued, "Beyond simply causing inconvenience in gameplay, this incident raised concerns regarding the security of users' PCs and personal data, leaving fundamental doubts about whether our service can be used with peace of mind. We deeply bow our heads in apology for burdening players with checking for actual damage and forcing them to worry about potential secondary harm."
According to the investigation findings released alongside the statement, the incident began on September 27 at 10:59 AM when a domain used for certain game services (insightjs.com) was hijacked by a third party. On the same day between 3:41 PM and 3:42 PM, four official CDN script files downloaded by the launcher were tampered with, and from October 30 at 3:52 AM, malware was distributed to users' PCs via the modified scripts. Level Infinite detected the anomaly on November 4 at around midnight, replaced three files with clean versions by 2:23 AM (first response stage), and completed a CDN cache refresh for the remaining file at 12:09 PM on the same day (second response stage). The mobile version was not affected by this incident.
Level Infinite urged all users who launched the Windows PC launcher at least once after 3:41 PM on September 27 to conduct a security check. Starting at 8:00 AM on November 5, a feature that automatically detects and deletes the malicious program upon running the official PC client was applied, while a separate manual inspection and removal guide was provided for users who wish to check directly without running the launcher.
In addition, the publisher is preparing in-game compensation as an apology and plans to review and respond to reports submitted through official customer support if users suffer gameplay damages, external service account compromises, or secondary financial losses from this incident. To prevent recurrence, Level Infinite plans to implement improvements such as reinforcing security monitoring systems, establishing an external resource integrity verification framework for the launcher, and applying the principle of least privilege across launcher features.
Below is the manual security check procedure announced by the operations team for the Nikke PC launcher.
Hello, this is the Goddess of Victory: Nikke operations team.
We deeply apologize for causing great concern and distress to Commanders through this PC launcher security incident.
We ask all Commanders who launched the Windows PC launcher at least once after 15:41 on September 27 to perform a security check and take necessary action.
Security checks and actions can be performed more conveniently through the security feature (ACE) provided by the official PC client.
For instructions on how to use this feature, please check the [Notice on PC Launcher Security Incident and Follow-up Measures] announcement.
If you currently do not have the PC launcher installed or wish to conduct a security check without using the launcher, please follow the guidelines below.
This security incident occurred within the PC launcher and did not affect the mobile version.
Accordingly, Commanders who only use the mobile version do not need to perform a separate security check regarding this incident.
1. Preparation Before Security Check
Before starting the security check, please disconnect from the network and completely close the NIKKE game, launcher, and Google Chrome browser.
Please check the system tray at the bottom right of your PC screen to ensure no NIKKE icon remains.
We recommend not reopening the NIKKE PC launcher until the security check is complete.
2. Security Check
① Locate Launcher Log File
Right-click the NIKKE icon on your desktop and select [Open file location] to open the NIKKE launcher installation folder.
In the installation folder, locate the file at the following path:
└ Launcher\intl_service\debug.log
└ Example: C:\NIKKE\Launcher\intl_service\debug.log
└ Example: C:\NIKKE_GOOGLE\Launcher\intl_service\debug.log
② Check Log Contents
1) Right-click the debug.log file and select [Open with] → [Notepad] to open the file.
2) Press Ctrl + F to search for the following text string:
└ k2f_chan registered
If this string is found, a malicious program may have executed on your PC.
Please proceed according to the malware removal instructions below.
Even if the string is not found, security risks cannot be entirely ruled out.
We recommend updating your antivirus program to the latest version and running a full system scan.
3. Remove Identified Malware
The procedures below include modifying files and registry entries.
Please ensure you verify the specified paths and items before proceeding, and take care not to delete any other items.
① Delete Abnormal Registry Entry
1) Press Win + R, type regedit, and select [OK].
2) Paste the following path into the address bar at the top of the Registry Editor and press Enter:
└ HKEY_CURRENT_USER\Software\Classes\CLSID
3) Check for an entry with the following name under the above path:
└ {E77CC89B-7401-4C04-8CED-149DB35ADD04}
4) If the entry exists, right-click it and select [Delete].
Entries with the same name may exist under other paths, so be sure to delete only the registry entry under the path specified above.
② Reboot PC
After deleting the registry entry, reboot Windows.
③ Delete Abnormal DLL File
1) After rebooting the PC, press Win + R, paste the following path, and press Enter:
└ %LOCALAPPDATA%\Google\Chrome\User Data\
2) Check if there is a subfolder under that path that meets both of the following conditions:
- Inside the PlatformExperienceHelper folder, there is a subfolder whose name consists solely of 64 hexadecimal characters (digits 0–9 and lowercase letters a–f)
- Inside that subfolder, the platform_experience_helper.dll file exists
3) Delete the 64-character named subfolder only if both conditions above are met.
Notes
- The PlatformExperienceHelper folder may contain normal Chrome files, so please take care not to delete the entire folder.
- If the PlatformExperienceHelper folder does not exist at that path, the abnormal DLL file is not installed; proceed to the next step.
④ Delete Abnormal Downloaded File
1) Open the folder at the following path inside the NIKKE launcher installation folder:
└ Launcher\log\tinyget
2) Check if there is a file with a size of 205,135 bytes (approx. 200 KB) and a filename matching a format similar to below:
└ tinyget.<date>-<time>.log
3) Delete any file matching the above conditions. If no such file exists, proceed to the next step.
⑤ Delete Launcher Local Cache
1) Press Win + R, paste the following path, and press Enter:
└ %APPDATA%\nikke_launcher
2) Delete the entire tbs_cache folder located at that path.
4. Account Security Check
We recommend taking the following account protection measures from a different device unaffected by malware, or after completing the security check on your current PC.
① Change the password for any accounts that have a history of being used on that PC.
② If you used or stored API keys or access tokens on that PC, please revoke the existing keys and tokens and issue new ones.
5. System Security Scan
Please update Windows Security or another trusted antivirus program to the latest version and run the following scans:
- Full antivirus scan
- Windows Security Offline Scan (Microsoft Defender)
If abnormal issues persist after completing all the measures above, please contact Customer Support.
We sincerely apologize once again for imposing the burden and inconvenience of performing manual checks upon our Commanders.
Level Infinite
