NIKKE PC Launcher Hit by Tampered CDN Scripts, Malware Risk

Timeline of the incident

According to the operators, a domain called insightjs.com, used for part of the game service, was hijacked on September 27 at 10:59 a.m. (Japan time). Around 3:41 p.m. the same day, four script files that the launcher loads from the official CDN were altered to include code connecting to a specific domain. Distribution of malicious programs through them began on October 30 at 3:52 a.m.

The team noticed an anomaly around midnight on November 4. It replaced three malicious files between 2:04 and 2:23 a.m. and finished refreshing the CDN cache for the fourth at 12:09 p.m. A fixed launcher went out around 2:30 a.m. The cause of the tampering is still under investigation, along with the scope of impact.

What players should do

Anyone who launched the Windows launcher after 3:41 p.m. on September 27 is asked to run a check. Since 8 a.m. on November 5, Tencent's ACE (Anti-Cheat Expert) module in the PC client can detect and remove the malware. Browsers such as Chrome should be fully closed first, or some files may not be deleted. A manual procedure exists for those without the launcher, but it is complex; a log entry reading "k2f_chan registered" indicates the malware may have run.

Afterward, players should change passwords used on the PC from a safe device, revoke and reissue API keys and access tokens, and run a full antivirus scan plus a Microsoft Defender offline scan. The team will give in-game items as an apology and asks users to contact support about account anomalies or financial losses.

Planned countermeasures include stronger monitoring, integrity checks on external resources the launcher loads, and tighter permissions for launcher functions. Japan is NIKKE's largest market at 48.3% of revenue, per a Sensor Tower tally from May 2026. On X, some users criticize slow communication and inadequate compensation, while others sympathize with the operator.