Warning for NIKKE PC players: do not open the Goddess of Victory: NIKKE PC launcher until Level Infinite confirms it is safe.
The official PC launcher for Goddess of Victory: NIKKE appears to have been hijacked to deliver malware to players’ computers. According to an independent security analysis published on November 3, attackers modified official JavaScript files hosted on publisher Level Infinite’s own content delivery network (CDN). The launcher loads those files every time it starts, and on some launches they quietly downloaded a remote-access tool onto the player’s PC.
As of November 4, neither developer Shift Up nor publisher Level Infinite has issued a public statement. The official NIKKE accounts have continued posting regular 4th Anniversary event updates while the community scrambles to work out who was affected.
What Happened to the NIKKE PC Launcher
Players on the Chinese forum NGA were the first to raise the alarm, and a detailed technical write-up followed on GitHub. Based on that analysis, here is the reported timeline:
- September 27, 2026: Official launcher files on Level Infinite’s CDN were modified to load a script from an outside domain, insightjs.com.
- October 24, 2026 (at the latest): On some launches, that script began downloading and running a remote-access agent.
- October 29, 2026: The NIKKE 4th Anniversary update went live, bringing a wave of returning players into the launcher.
- November 3, 2026: Level Infinite reportedly replaced the modified files, though some CDN servers kept serving infected copies for a while. The attacker’s server stopped responding that evening.
How the attackers gained access to Level Infinite’s CDN is still unknown. Because the malicious code came from the publisher’s own servers, antivirus software and players had little reason to treat it as suspicious.
What the Malware Can Do
The payload described in the analysis is far more than adware. While the launcher was open, it could reportedly:
- Run commands remotely and give attackers control of the PC
- Browse, read and download personal files
- Take screenshots of every connected monitor
- Steal saved browser passwords, cookies and login tokens
- Pull data from Windows Credential Manager, SSH keys and cloud or AI service API tokens
- Target 28 different browser-based cryptocurrency wallets
On Windows with Google Chrome installed, the agent reportedly installs itself so that Chrome loads it, which means it can keep running even after the NIKKE launcher is closed. Players running the launcher on Linux or Steam Deck through Proton are also considered at risk.
Who Is Affected
The reports only concern the standalone NIKKE PC launcher. There are no reports of problems with the iOS or Android versions, although Level Infinite has not officially confirmed that mobile is safe either. Until it does, playing on mobile is the safer option for anyone who wants to keep up with the anniversary events.
NIKKE itself is not sold on Steam, which is why this incident centers on Level Infinite’s own launcher rather than Valve’s platform. The game’s only Steam presence is the NIKKE collaboration DLC for Stellar Blade. If you are taking a break from the PC launcher until this is resolved, our Most Played on Steam chart is a good place to find something else to play in the meantime.
It is also important to note that the investigation has not yet been verified by Shift Up, Level Infinite or a major antivirus vendor. Some community members have urged caution until there is official confirmation. Given what the malware is reported to steal, though, waiting before taking action is not worth the risk.
How to Check If Your PC Is Infected
If you have opened the NIKKE PC launcher since late September, check your install now:
- Open your NIKKE install folder and go to Launcher\intl_service.
- Open debug.log with a text editor such as Notepad.
- Search the file for k2f_chan. If you find it, the remote-access agent was launched on your PC.
The researcher behind the write-up has also released a free, open-source, read-only scanner called NIKKE Launcher Check for Windows, Linux, Steam Deck and macOS. It only reads files, makes no network connections and reports whether your PC looks clean, exposed or infected.
What to Do If You Played NIKKE on PC
If the check finds traces of the malware, treat the PC as compromised:
- Close the NIKKE launcher immediately (end nikke_launcher.exe in Task Manager if needed) and disconnect the PC from the internet.
- Do not open the launcher again until Level Infinite confirms a fix, and clear its cache before using it in the future.
- From a clean device, such as your phone or another computer that never ran the launcher, change your important passwords, starting with email, banking, Steam, Discord and any account saved in your browser.
- Turn on two-factor authentication and log out of all active sessions on those accounts.
- Revoke and regenerate any API tokens and SSH keys stored on the PC.
- If you use a browser crypto wallet, move your funds to a brand new wallet.
- Run a full scan with up-to-date antivirus software. If you are not confident the PC is clean, a full Windows reinstall is the safest fix.
Even if you find nothing, consider changing passwords from a clean device if the launcher was open on your PC on or after October 24.
Our Take
This is one of the most serious security incidents a live-service game has faced in years. Players did nothing wrong here. They opened an official launcher, from an official source, during an anniversary event designed to bring them back, and the publisher’s own servers allegedly served them a password and crypto stealer for weeks.
Silence is the worst possible response. Players need Level Infinite to confirm what happened, which dates and regions were affected, whether mobile and other Level Infinite games on the same infrastructure are safe, and what it plans to do for anyone who lost accounts or money. We will update this story as soon as an official statement arrives.
Did you find the k2f_chan string in your NIKKE logs? Let us know in the comments and warn your fellow Commanders.
