✦Tech

NIKKE PC Launcher Malware: Timeline, What Is Confirmed, and What Is Still Claimed

Level Infinite confirms the NIKKE PC launcher was tampered with and could run malware. Timeline, confirmed facts, researcher claims and next steps.

A Axortex · Nov 4, 2026

Updated November 5, 2026 (KST)

For more than a month, the official PC launcher for Goddess of Victory: NIKKE loaded files that had been altered by an outside party. Developer Shift Up and publisher Level Infinite have now confirmed that running the launcher "could execute malicious programs." Most of the technical detail circulating online, including credential theft, crypto wallets and SSH keys, comes from one independent researcher's report. The company has not confirmed that detail.

This article separates what the companies have confirmed from what the researcher claims and from what nobody has established yet.

Timeline

The official follow-up notice gives times without a time zone. They match the researcher's GMT timestamps plus nine hours, so they are treated as KST below. Rows marked "researcher" come from MotherSphere's GitHub report. Rows marked "official" come from Level Infinite's notice as reposted on Ruliweb.

KST	UTC	Event	Source
Sep 27, 10:59	Sep 27, 01:59	`insightjs.com` registered (researcher). The official notice says the domain was "maliciously taken over" by a third party	Both
Sep 27, 15:41–15:42	Sep 27, 06:41–06:42	Four official CDN script files loaded by the launcher are modified	Both
Oct 24, 01:40	Oct 23, 16:40	Earliest agent start reported in the report's comments	Researcher
Oct 29, 00:46	Oct 28, 15:46	One file (`FeedList`) replaced with a clean copy at the origin, but some CDN servers keep the modified copy	Researcher
Oct 30, 03:52	Oct 29, 18:52	Malware distribution to user PCs begins, per the company	Official
Nov 3	Nov 3	Researcher publishes the report on GitHub (Inven Global)	Media
Nov 4, ~00:00	Nov 3, ~15:00	Team detects the abnormal scripts and starts responding	Official
Nov 4, 02:04–02:23	Nov 3, 17:04–17:23	Three of the four files replaced	Both
Nov 4, ~02:30	Nov 3, ~17:30	Client fix and update deployed	Official
Nov 4, 12:09	Nov 4, 03:09	CDN cache refresh completed for the last file	Official
Nov 4, 12:13	Nov 4, 03:13	First statement posted on X (@NIKKE_en)	Researcher
Nov 4, 14:25	Nov 4, 05:25	MTN reports that Nexon told employees to remove the launcher (MTN)	Media
Nov 4, by 17:08	Nov 4, by 08:08	Shift Up CEO Kim Hyung-tae's apology on X is reposted on Ruliweb	Media
Nov 4, 20:20	Nov 4, 11:20	All four files clean on the four CDN servers the researcher checked	Researcher
Nov 5, 08:00	Nov 4, 23:00	Scan-and-remove feature goes live in the official PC client	Official

The two sides disagree on when infections started. The official notice says distribution began October 30. The researcher's report cites an agent start on October 23 (GMT), which is October 24 in Korea. This explains why Korean media widely cited "after October 24".

Confirmed by Level Infinite / Shift Up

First notice (Nov 4). The team said it had found an anomaly in which the launcher's script file "may have been tampered with by a third party". It said it deployed a fix at about 02:30 KST and was still checking the scope of the impact (Inven). According to the researcher's report, the post named no files and gave players no steps (gist).

CEO apology (Nov 4). Kim Hyung-tae said Shift Up is working with Level Infinite to find a fundamental fix and is preparing follow-up measures. He apologized to "Commanders" (players) for the concern and harm (Inven, Ruliweb repost).

Follow-up notice (reposted Nov 5, ~08:12 KST). Level Infinite's notice (Ruliweb repost, apology and manual-check repost) confirms the following:

Some launcher files were altered by a third party, and running the launcher could execute malicious programs.
Players' PCs and account information "may have been exposed" to security risk.
Anyone who ran the Windows PC launcher at least once after September 27, 15:41 should check their PC.
From Nov 5, 08:00, the official PC client scans for and removes the malware. It uses the client's security feature (ACE) and can delete related logs, DLL files and registry entries after the player agrees.
The mobile version was not affected, and mobile-only players do not need to check.
The team is examining how the files were altered, including the CDN and network security environment.
Planned changes include stronger monitoring, integrity checks on external resources the launcher loads, and reduced launcher permissions.
Players with account anomalies or financial damage should contact in-game customer service. The notice does not mention compensation.

Claimed in the researcher's report (not confirmed by the company)

The researcher, MotherSphere, says the report is based on one infected machine and that the payload was analyzed statically and never executed (gist). The report claims the following:

What the tampered files did. Each tampered file loaded a script from insightjs.com, which downloaded a payload called insight.bundle.
Remote control. The payload is a remote-control agent, not a fixed stealer. Its exec command can run any program with the user's privileges. Other commands browse and download files and capture screenshots of every monitor.
Credential theft. The agent decrypts the NIKKE login saved by the launcher and takes browser-saved passwords. It also reads data from 28 crypto wallet extensions in Chrome profiles and checks 264 known paths for credentials and config files, including SSH keys, cloud credentials and API tokens.
Windows persistence. A DLL registered so that Chrome loads it keeps running after the launcher closes.
Linux and Steam Deck. Under Proton, the Windows persistence doesn't apply, but the operator can read files in the Linux user's home folder (Inven).
Administrator rights. Launcher version 0.0.6.841 requests administrator rights, so the agent may have run elevated. The report itself marks this as "reported."
No logs. Commands leave no trace in launcher logs, so finding nothing does not prove a PC is safe.

The company's notice does confirm malware and mentions DLLs and registry entries. It does not confirm the specific theft capabilities above.

Unknown

How the attacker got write access to the CDN. Both the company and the researcher say this is still under investigation.
How many players were infected and whether any data was actually taken. No figures have been published (Seoul Economic Daily).
When infections actually started. The company says October 30. The researcher's report cites October 23 (GMT).
The Steam version. None of the sources we read say whether the Steam release of NIKKE uses the same launcher files or was affected. The official notice refers only to the "Windows PC launcher."
Other Tencent / Level Infinite games. Boan News noted that titles sharing the distribution infrastructure, such as Battlegrounds Mobile, Honor of Kings and Arena Breakout: Infinite, could be exposed, but called this unconfirmed. The researcher writes that a circulating "all Tencent games hacked" list traces back to one anonymous 4chan post with no evidence. The report says there is no evidence other launchers were infected, and also no evidence that they are safe (Inven).
Who the attacker is. No source names one.

About Krafton. MTN reported that Nexon sent an urgent company-wide notice telling staff to remove the launcher from work PCs. According to MTN, Krafton said its security organization would review the issue but had launched no response specific to this incident. Boan News reported that Krafton and Netmarble had stepped up monitoring of internal devices. These reports describe how other companies protected their own staff. None of them claims that Krafton games were compromised.

Korean community reaction

On a Ruliweb thread reposting the CEO's apology (28 comments), most comments were angry or sarcastic:

Many criticized how long the notice took after the issue surfaced.
Some wrote that they had changed passwords, backed up data or reinstalled Windows.
Some doubted that the arrangement with the publisher would prevent a repeat.
A few said this apology sounded more courteous than earlier ones.

TechM also reported player criticism of Level Infinite's response as slow.

What players can do now

From the official notice (Ruliweb repost):

Fully close browsers such as Chrome, then start the official PC client and let it scan. Accept the removal prompt if it appears.
If you don't want to use the launcher, follow the official manual-check guide on the NIKKE homepage.
After a clean scan, or from an unaffected device, change the passwords of accounts used on that PC. Revoke and reissue any API keys or access tokens used or stored on it.
Report account anomalies or financial damage to in-game customer service.

From the researcher (gist):

Search Launcher/intl_service/debug.log in the install folder for k2f_chan. A match indicates the agent ran, but no match does not prove you are safe (Inven Global).
Delete %APPDATA%\nikke_launcher\tbs_cache before reopening the launcher. On Proton, delete the same path inside the Proton prefix.
If you were infected: log out all sessions from a clean device, move crypto to a new wallet with a new seed phrase, and rotate SSH keys and developer tokens. The researcher calls a Windows reinstall the safest option.

General advice (not specific to this incident): keep the launcher updated, change important passwords from a device you trust, and turn on two-factor authentication wherever it is offered.

FAQ

Is the NIKKE launcher safe now? Level Infinite says the tampered files were replaced by Nov 4 and that the client now scans for and removes the malware. The researcher found all four files clean on the servers they checked by Nov 4, 11:20 UTC. How the attacker got in has not been explained yet.

Was I affected? The company says anyone who ran the Windows PC launcher after Sep 27, 15:41 should check. Use the built-in scan or the official manual guide. The researcher's k2f_chan log check can confirm an infection but cannot rule one out.

Does it affect the mobile version? No. The official notice says only the PC launcher was affected.

Does it affect Steam or Steam Deck? None of the sources we read address the Steam release. The researcher says Linux and Steam Deck users running the Windows launcher through Proton faced the same risk to files in their home folder.

Were other Tencent or Krafton games hacked? This has not been verified. Claims about other titles are unconfirmed, and the reports about Krafton concern its internal security monitoring, not its games.

Sources

#nikke#goddess of victory nikke#shift up#level infinite#malware#supply-chain attack#pc launcher#cybersecurity

← Back to all posts