A NIKKE launcher update can remove malware traces that players need to understand whether their PC was exposed. In a November 5 update to an independent investigation, researcher MotherSphere warned that the client’s new cleanup checks can delete logs and other artifacts. Players should preserve evidence before reopening the launcher or clearing its cache.
This is a Windows launcher incident: the important boundary is between repairing the software that delivered an agent and establishing what happened on a computer where that agent already ran. Neither a working game nor an empty cache answers the second question.
The trusted launcher fetched an unexpected passenger
MotherSphere’s analysis describes attacker code in four JavaScript resources on Level Infinite’s content delivery network. The launcher loaded those resources as part of its ordinary operation. The player did not need to seek out a crack or a fake download.
The researcher reports that clean copies had reached all four checked CDN servers by November 4. That closes an observed delivery route; it does not retrospectively inspect affected computers. The subsequent cleanup feature introduced another complication: starting the client could erase evidence before the owner saved it.
A saved identity shows more than a cached domain
A separate public forensic report by SpringZali documents one Windows endpoint with agent initialization on November 1, 2 and 3. Its retained excerpts show a successful insight.bundle download, a k2f_chan registered message and a persistent k2f.agent.state entry. Later sessions resumed the same redacted identity.
That sequence supports execution and continuity between sessions. The report explicitly does not establish that a human operator connected, which commands were sent, or which passwords or files were stolen. A network indicator, agent execution and confirmed exfiltration are different findings.
During authorized cleanup, launcher files and cache were removed. The later absence of those artifacts describes the cleanup result. It cannot reconstruct the missing history or exclude a second payload.
Save the evidence before the repair
Close the game and launcher and disconnect the suspect PC from the network. Before removing files, preserve the launcher’s Launcher\intl_service\debug.log, its Launcher\log folder and the applicable launcher cache under %APPDATA%. Keep the copy private: logs and browser storage can contain account secrets.
MotherSphere’s check documentation explains that deleting or reinstalling the game also removes relevant logs. A result with no surviving traces has limited meaning after that evidence is gone. Avoid cleanup commands posted by strangers, and obtain current recovery instructions through the game’s official support channels.
Security software may remove a visible payload while another module or a persistence mechanism remains. On an affected Windows PC, download Gridinsoft Anti-Malware, update its database, run a Full Scan, review and remove detections, then restart and check again. Preserve evidence first. A scan cannot recover stolen credentials or prove that no data was accessed.
Use a clean device to secure exposed accounts and revoke active sessions. The broader fake-installer investigation shows a different delivery route; here, trusting an authentic launcher was insufficient. The practical goal is to preserve the history, remove compromise and recover accounts as separate tasks.
References
- MotherSphere. NIKKE PC launcher compromise. Updated November 5, 2026; accessed November 6, 2026.
- SpringZali. Redacted incident and forensic report. Investigation November 4, 2026; accessed November 6, 2026.
- MotherSphere. NIKKE Launcher Check: checks and evidence limitations. Accessed November 6, 2026.
