If you play NIKKE on PC, the question you want answered is whether your machine is safe. As of November 4, 2026, no official guidance answers it.
NIKKE's official X accounts said only that the team found an issue indicating the PC launcher's script files "may have been tampered with by a third party," that a client fix and update went out at around 02:30 on November 4 (UTC+9), that the impact is still being checked, and that follow-up measures will come in a separate notice.
The notice never says malware.
Malware, remote control and data theft are claims from a GitHub report posted by the account MotherSphere and from press coverage citing it, and the report itself says it is based on one infected PC plus findings other users posted in its comments, and that the payload was analyzed without being run.
So every claim below is labeled by source. Times are in UTC+9 with GMT alongside, because the report uses GMT. This is a developing story, and this page will be updated with dates as new official notices arrive.
Official notice vs GitHub report and press (as of Nov 4)
| Question | Official notice (NIKKE operators) | GitHub report and press (not officially confirmed) |
|---|---|---|
| What happened? | An issue indicating the PC launcher's script files may have been tampered with by a third party | Report: four JavaScript files on Level Infinite's CDN were modified. Some outlets describe a possible supply chain attack |
| Is it malware? | The notice does not use the word | Report: the modified files could download and run a remote control program with command execution, file access, screen capture, and collection of browser data and crypto wallet files |
| When did it start? | No start date given | Report: files modified on Sept 27; earliest reported run on Oct 23 GMT, sourced from a user comment. That is not a safe cutoff |
| Is it fixed? | Client fix and update at around 02:30 on Nov 4 (UTC+9) | Report: three files replaced just before that, while the fourth was still modified on some CDN servers at 07:26 UTC+9. It says none of this undoes anything on machines already infected |
| How many players? Any data leak? | Impact still being checked | Press: the number of infected users and any actual leak are unconfirmed. The Digital Times reports that Korea's KISA says incidents affecting the Korean market or users fall under breach reporting or investigation; whether either has begun is unconfirmed |
| How did the attacker get in? | Not addressed | Report: how the attacker got write access is unknown. The attacker's identity is unconfirmed |
| What should players do? | No instruction to stop using, uninstall, or check for infection. Follow-up in a separate notice | Report: do not open the launcher until the fix is confirmed, and clear the cache first. Some outlets advise changing passwords and running a virus scan |
| Mobile and other setups | No statement | Report: counts Linux and Steam Deck runs through Proton as at risk, and gives no verdict on mobile. Some Korean press say mobile impact is unconfirmed |
What should you do with your PC? Three layers of advice
The answer depends on who is speaking, so read it in three layers. Layer one is official: the impact is being checked and follow-up measures will be announced. There is no instruction to stop running the launcher, to uninstall it, or to check for infection.
Layer two is what the report tells everyone: do not open the launcher until Level Infinite confirms the fix, and before you open it again, delete the cache folder, which the report gives as %APPDATA%\nikke_launcher\tbs_cache.
The report also tells everyone to block the attacker's server addresses in the hosts file, router or firewall; those addresses are not repeated here.
This advice was written before the official notice, and neither the notice nor the report says whether the official fix and update meets that condition. Layer three is what the report lists for infected machines.
Close the launcher or disconnect from the internet (how to open Task Manager lets you confirm it is really closed). Remove what it left in Windows (see the first question below). Then, from a clean device, change passwords in this order: NIKKE, email, Discord, banking, then everything saved in your browser.
Turn on two-factor authentication, sign out of all sessions, revoke developer tokens and keys, and move crypto funds to a new wallet. The report calls reinstalling Windows the safest option; if you are weighing that, note your Windows version and specs first. Layer three is the report author's judgment, not an official procedure.
Neither the notice nor the report says that uninstalling is enough, that runs before October 23 were safe, that updating makes you safe, or that mobile is safe.
Timeline in UTC+9, with GMT in parentheses
- 1Sept 27, 15:41 (06:41 GMT): four files allegedly modifiedReport claim. It says four JavaScript files the launcher loads from the CDN changed at this time, and that players who launched afterward may still have modified files in their cache. The official notice gives no start date.
- 2Oct 24, 01:40 (Oct 23, 16:40 GMT): earliest reported runReport claim, sourced from a user comment. Outlets split between October 23 and 24 for two reasons: the report first said October 24 and later corrected to this time, and this time falls on October 23 in GMT but October 24 in UTC+9. It is the earliest report, not a safe cutoff. The report also says the program ran only on some launches, but that tells you nothing about your own PC.
- 3Oct 29, 00:46 (Oct 28, 15:46 GMT): one file allegedly restored at the origin serverReport claim. One of the four files went back to a clean version on the origin server, while some CDN servers kept serving the modified copy.
- 4Nov 4, 02:04 to about 02:30: files replaced, official fixThe report says three files were replaced between 02:04 and 02:21 (Nov 3, 17:04 to 17:21 GMT). The official notice says a client fix and update went out at around 02:30 UTC+9. The two times are close, but officials have not confirmed they are the same action.
- 5Nov 4, 07:26 (Nov 3, 22:26 GMT): modified file allegedly still on CDN serversReport claim. Two CDN servers were still serving the modified file, nearly five hours after the official fix time.
- 6Nov 4, 11:00 to 12:13 (02:00 to 03:13 GMT): last report update, then the official noticeThe report's body was last updated at 11:00, when it still said there was no official statement. The notice went out on NIKKE's official X account at 12:13, so the report's advice does not reflect it. As of the evening of November 4, neither the notice nor the report's body says the launcher is safe to reopen.
What players are questioning, and the official position
- Timing: some players question the nearly ten hours between the 02:30 fix and the 12:13 notice. The notice does not explain the gap; the official position is that the impact is being checked and a follow-up notice will come.
- Wording: some players say the notice's language is too mild for what is alleged. The notice speaks of possible tampering, and the official position is that the impact check is not finished.
- Follow-up: some players and press say no clear follow-up plan had appeared by the afternoon of November 4. The official position is that follow-up measures will be announced separately, and the notice does not say which company answers for what. This article makes no finding on responsibility.
- Account and wallet fears: some players worry about secondary damage to accounts and crypto wallets. Officials have not said whether any data was exposed; their position is that the impact is still being checked.
How this article gets updated
This is a living article. It changes only when NIKKE's official channels post a follow-up, a public agency issues guidance, or credible press reports something new, and each change carries a date. If the report changes its advice, that goes in labeled as the report's advice.
Community posts are not used as evidence. The scale of the impact, any data exposure, the entry route and the attacker's identity stay marked unconfirmed until an official statement or credible reporting settles them.
That is also why we leave out the report's infection markers and file names, apart from the cache path: several were corrected along the way, and a wrong marker can lead to false reassurance.
