Level Infinite has gone from "may have been tampered with" to a full admission. In an apology published on November 5, the Goddess of Victory: NIKKE operator said malware reached players' PCs through its own Windows launcher, according to Inven Global, and it is now asking anyone who ran that launcher since September 27 to run a security check.
We couldn't check Level Infinite's original notice directly, so the company's statements below are as Inven Global reports and reproduces them. The technical detail comes from BleepingComputer, which published its report before the apology.
The timeline Level Infinite gave
Inven Global says the published investigation runs like this:
- September 27, 10:59 AM: a domain used for certain game services, insightjs.com, was hijacked by a third party.
- September 27, 3:41 PM to 3:42 PM: four official CDN script files downloaded by the launcher were tampered with.
- October 30, 3:52 AM: malware began reaching users' PCs through the modified scripts.
- November 4, around midnight: Level Infinite identified the anomaly, and it replaced three of the files with originals by 2:23 AM.
- November 4, 12:09 PM: the CDN cache was refreshed for the remaining file.
- November 5, 8:00 AM: the official PC client gained a feature that detects and deletes the malicious programs when it launches.
Inven Global's article doesn't give a time zone for those times. It also says the mobile version wasn't affected, and the notice it reproduces tells mobile-only players they don't need to run a check.
What the malware could do
Level Infinite's apology, as reported, doesn't say what was taken or how many players were hit. BleepingComputer fills in part of the capability picture, with some of it resting on independent researcher MotherSphere's GitHub analysis rather than on the company.
According to that analysis, the payload installed a remote-access agent called K2F that could run commands, browse and download files, capture screenshots, collect NIKKE account credentials and steal browser data. BleepingComputer says it examined two of the modified scripts itself and confirmed they held an obfuscated loader. It also found strings in a DLL sample pointing to theft of cryptocurrency wallet data, including recovery phrases and private keys, from browser extensions such as MetaMask and Phantom. BleepingComputer stresses that it's unknown whether that component was deployed on infected systems or whether any crypto was actually stolen.
The researcher also claimed a tampered copy of the fourth file was still being served at 22:26 GMT, BleepingComputer reports. Its article predates the apology, whose timeline says the fourth file's cache was refreshed at 12:09 PM on November 4, and it says Level Infinite hadn't answered its request for comment.
What to do if you play on PC
The notice reproduced by Inven Global asks anyone who launched the Windows launcher at least once since 15:41 on September 27 to check their machine. Note that window opens about a month before the October 30 distribution date, so a clean-looking calendar isn't a reason to skip it.
- Use the client or check by hand. The notice offers a security feature in the official PC client, plus a manual route for anyone who doesn't want to open the launcher. It recommends not relaunching the launcher until the check is complete.
- Search the log. Open
Launcher\intl_service\debug.login your NIKKE install folder and search fork2f_chan registered. If it's there, the notice says a malicious program may have run, and it lists removal steps covering a registry entry and specific files. Follow those exactly, as it warns against deleting anything else. Inven Global has the full list. - Don't treat a clean log as an all-clear. The notice says risk can't be completely ruled out, and it recommends a full antivirus scan and a Microsoft Defender Offline scan.
- Change your passwords. Do it on another device or after the check, for accounts used on that PC, and revoke and reissue any API keys or access tokens stored there.
BleepingComputer goes further than the notice: it says players who find they were compromised should reinstall Windows, and change credentials from a clean device.
Compensation and next steps
Level Infinite is preparing in-game compensation, Inven Global reports, and will take reports through its customer support center from anyone who suffered gameplay disruption, secondary damage to external accounts or financial losses. Inven Global's subheading says the team is reviewing responses to financial losses once they are verified with customer support, which isn't a promise of repayment.
The company also says it plans stronger security monitoring, integrity checks on external launcher resources and minimum-privilege rules for each launcher feature.
Mason's take: This is the notice players needed sooner. It has dates, a log file to search and a list of what to change, and "An official program launched to enjoy the game should never threaten user safety under any circumstances" is about as plain as these statements get. The gap is scale. Until Level Infinite says how many PCs were reached and what was taken, I'd assume the worst for any machine that ran the launcher and act on the password advice today.
Reporting notes
