The official NIKKE launcher handed out malware for five days, and the trap was set in September

If you play Goddess of Victory: NIKKE on a Windows PC, the game's own launcher may have put malware on your machine. Level Infinite, the Tencent-owned publisher, apologised on Thursday 5 November and published a timeline that makes uncomfortable reading. A third party took over insightjs.com, a domain used by some of the game's services, on 27 September. That afternoon, between 15:41 and 15:42 Korean time, four JavaScript files the launcher downloads from the company's CDN were altered. They sat there for weeks. From 03:52 on 30 October they started delivering a malicious program.

Nobody at the company noticed until around midnight on 4 November. Three files were replaced within a few hours and the fourth was flushed from the CDN cache at midday. The mobile game wasn't affected. Level Infinite hasn't said what the malware does or how many PCs received it, and it's taking reports of hijacked outside accounts and lost money through customer service, with in-game compensation promised.

The rule is simple: if you ran the PC launcher even once after 15:41 on 27 September, check your machine. Since 08:00 on 5 November the official client scans for the malware and removes it, after asking you to close your browsers. Korean games site Inven published the manual check too: look for the text "k2f_chan registered" in the launcher's Launcher\intl_service\debug.log file, and for a folder called PlatformExperienceHelper inside Chrome's user data holding platform_experience_helper.dll. If either turns up, remove them, restart and run a full scan plus a Microsoft Defender Offline scan. Then change the passwords for every account you've used on that PC, ideally from another device, starting with email and banking.

Tendvane can't clean an infection, but once the PC is clean its Privacy & accounts check helps you see which important accounts still rely on a password alone.