Springz

Volunteers needed 🛡️ NIKKE launcher incident, Phase 2. Two goals: → Ask SHIFT UP & Level Infinite about compensation for real losses, beyond in-game gifts → Help players report to the right authorities early, to reduce the risk of data misuse Right now it's hard to work out who to report to in your own country. We want to put that in one place, country by country. How you can help: • you know who to contact in your country (police, cybercrime unit, consumer office) • you can translate or proofread • you like checking facts and timelines Send me a message with what you can do and your country or region. First drafts about a week after a small team forms. No promises on results. If you were affected: keep your original launcher logs (debug.log) unchanged and private. Please don't DM or post them yet, we're reviewing a safe submission process and will announce it publicly if it becomes available. Never send passwords, recovery codes, IDs or keys. Details and what to do if you were hit: thread below ↓ Community call, not affiliated with SHIFT UP or Level Infinite. We'll announce any official contact method publicly.

Thanks for helping with this 🙏 Perro, Defender found it in an Edge folder, so treat passwords saved in Edge as exposed: change them from another device and sign out of all sessions. Also tell NIKKE Customer Support. If you share logs, send only the log files, no browser data.

Small correction: the registry key and the Chrome DLL folder sit outside the NIKKE folder, so uninstalling doesn't remove them, and the official launcher check or the manual guide can still find them. What uninstalling removes is the log.

Mostly the same signs, but community tools aren't official, so the official check (the launcher's built-in scan or the manual guide) is the reference. Your clean scans are good signs. Just make sure you changed passwords from another device and turned on 2FA.

No popup is a good sign, but not a guarantee: some players' antivirus still found leftovers after the check. The publisher's guide also asks for a full antivirus scan and a Windows Security offline scan, and new passwords from another device.

Your manual check covers the same signs, so the launcher scan is an extra confirmation, not a must. The publisher says the current launcher is safe (close Chrome first). Some players found leftovers only with a full antivirus scan, so I'd run one either way.

Those clean scans are good signs. k2f_chan means the program ran at least once, so what matters most is what you did: new passwords from another device. Also sign out of all sessions, turn on 2FA and replace any API keys or tokens. Nobody can promise 100%.

If "k2f_chan" didn't show up at all, "k2f_chan registered" isn't there either. No registry key, nothing in Chrome and a clean scan are good signs, not a guarantee. To finish, let the current launcher scan (close Chrome first) and change passwords from another device.

Not for sure. The publisher only names Chrome. The community report (not confirmed) lists several Chromium browsers, and the program could also copy files directly. So if you saved passwords in Opera GX on that PC, change them too and sign out of sessions.

Then you did the key steps. k2f_chan means the program ran at least once, but no DLL, no registry key and clean scans are good signs (not a guarantee). To finish: sign out of all sessions, turn on 2FA, and replace any API keys or tokens.

Fair. The publisher's follow-up notice lists plans: stronger security monitoring of the launcher, integrity checks for what it loads, and minimum permissions for each feature. No dates yet. Until then, it's your call whether to use the PC client.

The folder itself is normal, and an Edge icon on it doesn't mean anything. The sign from the official guide is a subfolder with a 64-character name (0-9, a-f) with platform_experience_helper.dll inside. If you don't see that, it's a good sign.

It removes what it finds, which is the main part. But anything already taken can't be undone, so also change your passwords from another device and sign out of other sessions. Some players say a full antivirus scan still found leftovers afterwards, so run one too.

Yes, that device should be fine. Per the publisher, the launcher files were changed on Sep 27 and the malware went out from Oct 29, so a PC that hasn't run the launcher since before September couldn't get it. When you turn it on, update the launcher (close Chrome first).

Not launching since Sunday doesn't undo earlier launches. The "simple clean" is what the official guide asks for: let the current launcher scan (close Chrome first) or do the manual check, run a full antivirus scan, then change passwords from another device.

No problem 🙂 It means: in your important accounts (email, Google, Discord, Steam...), open the security settings and use "sign out of all other devices" or "sign out everywhere". Do it after you change the password, from a device you trust.

Yes, you can allow it 🙂 Those are your own lines, and they only stop your PC from reaching those domains. Defender flags any change to the hosts file, so the alert is expected.

Glad you're OK 🙂 You can still tell Customer Support: the publisher asks anyone who thinks they were affected to contact them. Your own notes are enough (when you saw k2f_chan, what you checked, when you changed passwords). Keep them with dates.

Thanks, fair correction. They do say Customer Support will review each case. What they haven't said yet is how losses are assessed or what can be compensated, and that's what we're asking about.

If k2f_chan was in the log, the malware ran at least once. The official guide names that E77 key; I've seen no verified report of a different one. Easiest check: install the launcher from the official site, close Chrome, let it scan. Then change passwords from another device.

Short version: the official NIKKE PC launcher was tampered with (Sep 27 to Nov 3) and could install malware. It's fixed, the attacker's domain is down, and the launcher now checks your PC. On PC: close Chrome, start the launcher, then change passwords from another device.