How to Check Whether the NIKKE Launcher Infected Your PC

If you opened the Goddess of Victory: NIKKE PC launcher during the compromise, the most important evidence may be sitting inside the same cache you have been told to delete. Clean first and you may erase the trail. Open the updated launcher first and its built-in repair process can remove more of it.

That makes the order of operations unusually important. Security researcher MotherSphere has released NIKKE Launcher Check, an open-source, read-only tool built specifically to look for traces of the attack on Windows, Linux/Steam Deck and macOS. It checks whether the malicious script reached the launcher, whether the remote-control agent ran and whether Windows persistence remains.

Before You Do Anything: Do Not Open the Launcher

Do not delete tbs_cache, reinstall the game or launch the updated client yet. The cache contains some of the artifacts the checker uses, while Level Infinite’s newer client can delete logs, DLLs and registry entries during its own cleanup.

1. Download the checker only from its official GitHub release page. For a 64-bit Windows PC, the file is named nikke-check-windows-x86_64.exe. Linux/Steam Deck and Apple-silicon macOS builds are listed on the same page.
2. Verify the download. Each release includes SHA256SUMS.txt. In Windows PowerShell, run Get-FileHash .\nikke-check-windows-x86_64.exe -Algorithm SHA256 from the download folder and compare the result with the published hash.
3. Run “Scan this computer” first. The quick scan checks the installation paths recorded by the launcher and the usual Wine-prefix folders. If it reports that NIKKE was not found, use Full scan or point Scan a folder… at the drive or game library where you installed it.
4. Save the report before cleaning anything. Turn on Hide my info before copying or sharing it. That redacts your computer name, username, agent ID and home-folder paths.

The checker does not upload your files, connect to a server or remove anything. It reads local traces and writes a report only when you choose to save one.

What the Four Results Mean

• No traces found: The scan did not find the malicious script or agent in the NIKKE files and system locations it checked. Evidence can disappear through cache deletion, launcher cleanup or ordinary log rotation, so this result describes what remains on the machine now.
• Exposed: The launcher loaded the malicious script or contacted insightjs.com, but the scan found no sign that the remote-control agent ran. MotherSphere recommends changing passwords from a clean device if the launcher was open on or after October 23.
• Infected: The scan found critical evidence: the agent was downloaded or executed, the launcher contacted analytics.insightjs.com, or the Windows persistence mechanism remains. Treat the PC as compromised.
• NIKKE not found: The quick scan did not locate the game or launcher data. It is a prompt to scan the correct folder or run the full scan, not a clean result.

The Fast Manual Check for K2F_CHAN

You can also inspect the launcher log yourself. Open the NIKKE installation folder, then open Launcher\intl_service\debug.log in a text editor and search for k2f_chan. A line reading k2f_chan registered means the agent downloaded and ran, even if the later adopted, resuming or agent started lines are absent.

MotherSphere’s technical write-up lists additional traces in Launcher\log\tinyget, the launcher’s code cache, Windows’ NTFS change journal, DNS logs and the registry. A missing debug.log does not settle the question: the updated launcher has removed that file on at least one reported installation.

If the Result Says Infected

1. Close the NIKKE launcher and disconnect the PC from the network.
2. Save the checker report before deleting files or registry entries.
3. Follow the tool’s What to do tab in order. Its instructions are tailored to the traces found on your system, including the cache, Windows DLL and registry persistence.
4. After preserving the report, delete the launcher’s tbs_cache before opening NIKKE again. Standard installs keep it under %APPDATA%\nikke_launcher; HMT and Google Play Games builds use their corresponding launcher folders.
5. Run a full antivirus scan and Microsoft Defender Offline. Then change email, game, browser-saved and reused passwords from a phone or computer that never ran the affected launcher. Replace exposed API keys, SSH keys and authentication tokens as well.

Some antivirus engines currently flag the checker itself because it is unsigned and contains plain-text lists of the same browser, wallet and credential paths used by the malware. Verify the file against the release hash before allowing that one file. Do not disable antivirus protection or exclude an entire folder.

Once the evidence is saved and cleanup is complete, return to our step-by-step NIKKE PC player guide for the launcher update, firewall option and post-cleanup checks.

ONGOING COVERAGE

NIKKE Launcher Coverage

The tracker, practical player guidance, and the reporting behind the incident.

See All →

Feature

NIKKE’s Launcher Crisis Needs More Than a Fix Notice

Feature

NIKKE PC Launcher Incident Tracker: What We Know, What Changed, and What Remains

News

A New NIKKE Analysis Says the Launcher Risk May Have Outlived the Launcher