{
  "id": "nikke-launcher-scripts",
  "url": "https://ohshit.app/incidents/nikke-launcher-scripts/",
  "title": "NIKKE PC launcher scripts linked to remote-access malware; client fix does not clean infected PCs",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-11-03",
  "date_is_approximate": false,
  "updated": "2026-11-04",
  "tags": [
    "NIKKE",
    "Supply chain",
    "Credentials"
  ],
  "ecosystems": [],
  "summary": "A researcher reports malicious code in four official NIKKE PC launcher scripts and remote-access payload execution. The operator acknowledges possible script tampering and reports a client update. A November 4 researcher recheck found the four known CDN assets clean, while stale caches and existing infections still need cleanup; victim scope is unknown.",
  "splash": "NIKKE PC launcher users; researcher reports Windows and Linux/Steam Deck through Proton exposure, not mobile-app impact.",
  "wipe": "Keep the launcher closed while checking exposure; verify official remediation, preserve evidence, clear stale cache and replace exposed secrets.",
  "in_the_wild": "disputed",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Stop the launcher and preserve evidence before cleanup",
      "hint": "Close the launcher, including its tray process; disconnect a suspected infected machine. Preserve Launcher/intl_service/debug.log, Launcher/log/tinyget and the launcher cache before deleting or reinstalling anything. The report says updates and server shutdown do not undo prior remote access. Keep an untouched private evidence copy. Before publicly sharing logs, redact Cookie lines and login_ticket, biz_ticket, uid, openid and sig values in tinyget.mem.log and dated tinyget API requests; path= may expose your Windows username."
    },
    {
      "title": "Optionally inspect preserved evidence with the researcher’s checker",
      "hint": "The original report links https://github.com/MotherSphere/NIKKE-Launcher-Check. Its README describes local checks on Windows, Linux/Proton and macOS/Wine, with no network access or cleanup; these are author claims, not an independent audit. Use the original project’s release and SHA256SUMS.txt to check the download. Run evidence checks before deleting tbs_cache, or retain a private copy. Enable Hide my info or --redact before sharing the report. No traces found only describes the paths checked; keep the manual checks and cleanup below. No tool was executed for this article."
    },
    {
      "title": "Hunt the published network and local indicators",
      "hint": "The report lists over 30 indicator values and 264 targeted credential/config paths; use its complete Indicators of compromise and target-paths.md sections. Network indicators: insightjs.com; analytics.insightjs.com; insightjs.org; 89.127.233.127; 89.126.250.172; https://insightjs.com/l.js?f=aegis; https://insightjs.com/l.js?f=images; https://insightjs.com/l.js?f=feedlist; https://insightjs.com/l.js?f=vue; https://analytics.insightjs.com/comm/assets/insight.bundle; https://analytics.insightjs.com/px/<32 hex>. Modified official URLs: https://sg-gpts.playerinfinite.com/comm/assets/lib/aegis-fix.min.js; https://na-webassets.playerinfinite.com/comm/nikke_launcher/assets/images.7fec4c32.js; https://na-webassets.playerinfinite.com/comm/nikke_launcher/assets/FeedList.feb647c9.js; https://na-webassets.playerinfinite.com/comm/assets/lib/vue-bucket.min.js. CDN nodes 43.175.144.148 and 43.175.145.181 served stale modified copies; they are shared delivery nodes, not proof of attacker ownership. insightjs.org was subsequently registered by a third party as a warning site. WormW’s expanded list has over 100 indicator rows; consult its full iocs/iocs.csv for hashes, ETags and local artifacts. Additional network hunting pivots: portal.insightjs.com; docs.insightjs.com; https://insightjs.com/l.js; https://insightjs.org/l.js; https://analytics.insightjs.com/px/<32 hex>.<kind>; https://analytics.insightjs.com/collect/<32 hex>.<kind>; https://analytics.insightjs.com/collect/<32 hex>; insightjs.com POST /speed; hooks.slack.com/(services|workflow|triggers). Bare /collect/<32 hex> is reported as a decoy; 89.126.250.172 is a reported address, not independently verified by this research. /speed is a facade-beacon pivot; Slack and official CDN traffic may be legitimate. Search debug.log for k2f_chan registered, Local Storage for k2f.agent.state, and Windows for the HKCU CLSID and DLL below. A match needs context and does not alone prove compromise; missing hashes, DNS or log entries do not establish safety. The revised original also lists shared CDN node 43.175.139.78, temporary %TEMP%\\k2f-keyscan-<time>-<rand>.db and %TEMP%\\k2f_screen_<unix time>_<n>.png for an older reported build; current temporary database/screenshots use %TEMP%\\k2f-bcreds-<unix time>-<random>.db and %TEMP%\\k2f_screen_<unix time>_<n>.jpg. Agent state may also be in compressed Local Storage leveldb .ldb files; preserve them. Use the original report for the added historical payload hashes and seven ETags. Shared CDN addresses are not attacker ownership indicators."
    },
    {
      "title": "Remove Windows persistence in the documented order or rebuild",
      "hint": "After preserving evidence, follow the researcher’s cleanup: remove only HKCU\\Software\\Classes\\CLSID\\{E77CC89B-7401-4C04-8CED-149DB35ADD04}, restart Windows, then remove the 64-hex subfolder containing platform_experience_helper.dll under %LOCALAPPDATA%\\Google\\Chrome\\User Data\\PlatformExperienceHelper. Leave the normal HKLM CLSID and the normal PlatformExperienceHelper parent folder. The DLL can stay locked until restart and has victim-specific hashes. Because arbitrary commands were possible, rebuilding from trusted media is the safer option when compromise is suspected; a clean antivirus result is insufficient."
    },
    {
      "title": "Replace secrets and revoke sessions from a clean device",
      "hint": "For suspected infection, change NIKKE/Level Infinite and other exposed account passwords, terminate active sessions, and revoke/reissue API tokens, SSH keys and developer/cloud credentials. If a wallet seed may be exposed, move assets using a clean device to a newly generated wallet. Static capability does not prove every listed secret or wallet was actually stolen. Proton exposes host-readable files and environment variables; absence of Windows Chrome persistence does not make a Linux host safe."
    },
    {
      "title": "Verify the official update and clear stale cache before resuming",
      "hint": "Check current official NIKKE notices and remediation before reopening. After preserving evidence, clear %APPDATA%\\nikke_launcher\\tbs_cache, including the corresponding path inside a Proton prefix, as the researcher recommends. Check launcher and proxy caches against the historical hashes/ETags in WormW’s attack-path report and full indicator CSV. Its November 4 07:14–07:20 UTC recheck found the four known assets clean, but cannot establish every edge or cache is clean; the reported client update has no published version threshold here. Cache removal or updating the launcher does not remove preexisting malware or stolen sessions. MotherSphere’s later 11:20 UTC check found those four files clean on four nodes for both hosts; keep the published malicious domains/IPs blocked because the initial publishing-access route remains unknown."
    }
  ],
  "sources": [
    {
      "name": "MotherSphere original technical report and indicator list",
      "url": "https://gist.github.com/MotherSphere/d6c049a09ba8ac3085c51ee9df24a4e5",
      "says": "Full original report read through the public GitHub Gist API. Separates own-host/static analysis from commenter reports; lists CDN cache observations, indicators and cleanup corrections. November 4 12:11 GMT revision adds a four-node 11:20 UTC clean recheck, later historical stale-cache observations, older payload indicators and compressed .ldb evidence.",
      "primary": true
    },
    {
      "name": "NIKKE official notice, public embed excerpt",
      "url": "https://publish.twitter.com/oembed?url=https%3A%2F%2Fx.com%2FNIKKE_en%2Fstatus%2F2117817602659770434&omit_script=true",
      "says": "Readable official excerpt acknowledges possible PC script tampering and a November 4 02:30 UTC+9 client fix. Direct X page returned 403; the embed truncates the remainder, which is not treated as read.",
      "primary": true
    },
    {
      "name": "MotherSphere public GitHub Gist API original-content copy",
      "url": "https://api.github.com/gists/d6c049a09ba8ac3085c51ee9df24a4e5",
      "says": "Full English file content and UTC creation metadata actually read; the same origin as the original report, not independent corroboration.",
      "primary": true
    },
    {
      "name": "WormW original sample analysis and current-asset recheck",
      "url": "https://raw.githubusercontent.com/WormW/nikke_malware_analysis/main/docs/en/attack-path.md",
      "says": "November 4 07:14–07:20 UTC recheck found all four known assets clean; documents historical poisoned copies, current hashes and cache limits. Original delivery observations are attributed to MotherSphere and third-party reports.",
      "primary": true
    },
    {
      "name": "WormW full indicator CSV",
      "url": "https://raw.githubusercontent.com/WormW/nikke_malware_analysis/main/iocs/iocs.csv",
      "says": "Over 100 indicator rows with confidence labels, including historical hashes and ETags, network patterns and local artifacts; shared services and historical indicators need context.",
      "primary": true
    },
    {
      "name": "MotherSphere NIKKE Launcher Check original documentation",
      "url": "https://raw.githubusercontent.com/MotherSphere/NIKKE-Launcher-Check/main/README.md",
      "says": "Author-described read-only local scanner, optional report writing, checks/verdict limits, release checksums and redaction. Not an independent tool audit or guarantee of a clean host.",
      "primary": true
    },
    {
      "name": "NIKKE Launcher Check v0.5.1 release metadata",
      "url": "https://api.github.com/repos/MotherSphere/NIKKE-Launcher-Check/releases/tags/v0.5.1",
      "says": "Published November 4 13:39:38 UTC, with platform assets and checksum file; downloaded executables were not run.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Researcher reports infection; operator acknowledges possible tampering, scope unclear.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Sep 27, 2026",
      "title": "Modified launcher files carry September timestamps",
      "body": "The researcher derives these dates from CDN file headers; this is not the public disclosure date."
    },
    {
      "date": "Oct 23, 16:40 UTC",
      "title": "Earliest agent start reported to the researcher",
      "body": "A commenter’s logs are reported evidence, not a vendor-confirmed campaign start."
    },
    {
      "date": "Nov 3, 16:57 UTC",
      "title": "Researcher publishes the technical report",
      "body": "GitHub Gist metadata records publication; analysis uses files, caches, logs and static payload inspection."
    },
    {
      "date": "Nov 3, 2026",
      "title": "Operator reports a client update around 17:30 UTC",
      "body": "The public official notice says November 4 around 02:30 UTC+9. No fixed launcher version is specified."
    },
    {
      "date": "Nov 3, 22:26 UTC",
      "title": "Researcher still observes a modified CDN copy",
      "body": "Two CDN servers still served FeedList after the stated client-update time; a client fix is not proof of a complete CDN purge."
    },
    {
      "date": "Nov 4, 2026",
      "title": "Official notice acknowledges possible third-party script tampering",
      "body": "The accessible public embed establishes this acknowledgment and the update time; the full notice was not readable during this check."
    },
    {
      "date": "Nov 4, 07:14–07:20 UTC",
      "title": "Researcher rechecks all four known official assets and finds clean responses",
      "body": "WormW reports clean bodies from the four URLs and both canonical and cache-busting FeedList requests. This is a bounded observation, not proof that every CDN edge, client cache or infected host is clean."
    },
    {
      "date": "Nov 4, 11:20 UTC",
      "title": "Original researcher finds clean assets on four checked CDN nodes",
      "body": "MotherSphere’s 12:11 GMT report says the four known files were clean on four checked nodes for both hosts. It reports stale FeedList delivery through 00:48 UTC and clean copies on those nodes by 03:12–03:21 UTC; other edges and infected hosts remain unverified."
    },
    {
      "date": "Nov 4, 13:39 UTC",
      "title": "Researcher releases an optional local evidence checker",
      "body": "GitHub release metadata dates NIKKE Launcher Check v0.5.1. The researcher describes read-only local checks; a negative scan is not proof of safety. Scan or preserve cache evidence before deleting it."
    }
  ],
  "body_markdown": "The November 3 original analysis reports four altered JavaScript files on Level Infinite’s official CDN loading an external script, which used the PC launcher’s embedded Chromium bridge to download a LuaJIT remote-access agent. The researcher analyzed one affected machine and static payload code, and labels additional users’ observations as reported evidence. Commands could read files, execute programs and capture screenshots; the analysis also identifies browser/credential theft capabilities and a Windows Chrome persistence path. Capability is not proof that every secret was stolen. No victim total or confirmed aggregate wallet loss is established.\n\nThe operator’s readable official excerpt acknowledges possible third-party script tampering and dates a client fix to November 4 around 02:30 UTC+9 (November 3 17:30 UTC). The researcher still observed a modified FeedList script on two CDN nodes at November 3 22:26 UTC. WormW subsequently reports that all four known official assets returned clean bodies during its November 4 07:14–07:20 UTC recheck, including both canonical and cache-busting FeedList requests. It cannot fully distinguish origin from intermediate cache state. These statements concern different layers: client updates, origin cleanup, CDN caches and already infected hosts. Do not treat the notice as proof that every cached copy or infected machine is clean. The full official notice remained inaccessible; no claims are made about its unread portion.\n\nThe report corrects earlier advice: the PlatformExperienceHelper parent is legitimate Chrome content, and onominan.tmp is not an infection marker. The attacker’s initial CDN/publishing access remains unknown. Mobile clients are outside the cited analysis, not proved unaffected. L3 reflects a widely used launcher and documented malicious distribution, while operator-confirmed execution scope is still unresolved.\n\n**November 4 original-research update:** MotherSphere now reports all four known files clean on four checked CDN nodes for both hosts at 11:20 UTC, while a checked public scan still received modified FeedList at 00:48 UTC. Its observed nodes took clean copies between 03:12 and 03:21 UTC. These observations extend, rather than invalidate, the earlier WormW recheck above; they do not prove a global purge. Preserve logs and cached Local Storage before clearing the documented launcher cache, including compressed `.ldb` files. Older reported payloads use additional temporary filenames and hashes, so absence of the latest hash does not establish safety. The initial CDN/publishing access and full victim scope remain unresolved.\n\n**Optional evidence checker:** The report now links its author’s NIKKE Launcher Check; release v0.5.1 was published November 4 at 13:39 UTC. The documentation describes a local scanner and distinguishes script exposure, agent infection, no traces found and missing installation. These are tool verdicts, not a complete forensic determination. Preserve the cache before cleanup and redact any shared report. Manual investigation, persistence removal/rebuild and clean-device secret rotation remain necessary when compromise is suspected. The tool was not executed or independently audited for this article."
}