NIKKE PC launcher scripts linked to remote-access malware; client fix does not clean infected PCs
A researcher reports malicious code in four official NIKKE PC launcher scripts and remote-access payload execution. The operator acknowledges possible script tampering and reports a client update. A November 4 researcher recheck found the four known CDN assets clean, while stale caches and existing infections still need cleanup; victim scope is unknown.
- Disclosed
- Nov 3, 2026
- Updated Nov 4, 2026
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- NIKKE PC launcher users; researcher reports Windows and Linux/Steam Deck through Proton exposure, not mobile-app impact.
- NIKKE · Supply chain · Credentials
- In the wild
- Disputed
- Researcher reports infection; operator acknowledges possible tampering, scope unclear.
What happened
The November 3 original analysis reports four altered JavaScript files on Level Infinite’s official CDN loading an external script, which used the PC launcher’s embedded Chromium bridge to download a LuaJIT remote-access agent. The researcher analyzed one affected machine and static payload code, and labels additional users’ observations as reported evidence. Commands could read files, execute programs and capture screenshots; the analysis also identifies browser/credential theft capabilities and a Windows Chrome persistence path. Capability is not proof that every secret was stolen. No victim total or confirmed aggregate wallet loss is established.
The operator’s readable official excerpt acknowledges possible third-party script tampering and dates a client fix to November 4 around 02:30 UTC+9 (November 3 17:30 UTC). The researcher still observed a modified FeedList script on two CDN nodes at November 3 22:26 UTC. WormW subsequently reports that all four known official assets returned clean bodies during its November 4 07:14–07:20 UTC recheck, including both canonical and cache-busting FeedList requests. It cannot fully distinguish origin from intermediate cache state. These statements concern different layers: client updates, origin cleanup, CDN caches and already infected hosts. Do not treat the notice as proof that every cached copy or infected machine is clean. The full official notice remained inaccessible; no claims are made about its unread portion.
The report corrects earlier advice: the PlatformExperienceHelper parent is legitimate Chrome content, and onominan.tmp is not an infection marker. The attacker’s initial CDN/publishing access remains unknown. Mobile clients are outside the cited analysis, not proved unaffected. L3 reflects a widely used launcher and documented malicious distribution, while operator-confirmed execution scope is still unresolved.
November 4 original-research update: MotherSphere now reports all four known files clean on four checked CDN nodes for both hosts at 11:20 UTC, while a checked public scan still received modified FeedList at 00:48 UTC. Its observed nodes took clean copies between 03:12 and 03:21 UTC. These observations extend, rather than invalidate, the earlier WormW recheck above; they do not prove a global purge. Preserve logs and cached Local Storage before clearing the documented launcher cache, including compressed .ldb files. Older reported payloads use additional temporary filenames and hashes, so absence of the latest hash does not establish safety. The initial CDN/publishing access and full victim scope remain unresolved.
Optional evidence checker: The report now links its author’s NIKKE Launcher Check; release v0.5.1 was published November 4 at 13:39 UTC. The documentation describes a local scanner and distinguishes script exposure, agent infection, no traces found and missing installation. These are tool verdicts, not a complete forensic determination. Preserve the cache before cleanup and redact any shared report. Manual investigation, persistence removal/rebuild and clean-device secret rotation remain necessary when compromise is suspected. The tool was not executed or independently audited for this article.
Crime-scene timeline
Sep 27, 2026
Modified launcher files carry September timestamps
The researcher derives these dates from CDN file headers; this is not the public disclosure date.
Oct 23, 16:40 UTC
Earliest agent start reported to the researcher
A commenter’s logs are reported evidence, not a vendor-confirmed campaign start.
Nov 3, 16:57 UTC
Researcher publishes the technical report
GitHub Gist metadata records publication; analysis uses files, caches, logs and static payload inspection.
Nov 3, 2026
Operator reports a client update around 17:30 UTC
The public official notice says November 4 around 02:30 UTC+9. No fixed launcher version is specified.
Nov 3, 22:26 UTC
Researcher still observes a modified CDN copy
Two CDN servers still served FeedList after the stated client-update time; a client fix is not proof of a complete CDN purge.
Nov 4, 2026
Official notice acknowledges possible third-party script tampering
The accessible public embed establishes this acknowledgment and the update time; the full notice was not readable during this check.
Nov 4, 07:14–07:20 UTC
Researcher rechecks all four known official assets and finds clean responses
WormW reports clean bodies from the four URLs and both canonical and cache-busting FeedList requests. This is a bounded observation, not proof that every CDN edge, client cache or infected host is clean.
Nov 4, 11:20 UTC
Original researcher finds clean assets on four checked CDN nodes
MotherSphere’s 12:11 GMT report says the four known files were clean on four checked nodes for both hosts. It reports stale FeedList delivery through 00:48 UTC and clean copies on those nodes by 03:12–03:21 UTC; other edges and infected hosts remain unverified.
Nov 4, 13:39 UTC
Researcher releases an optional local evidence checker
GitHub release metadata dates NIKKE Launcher Check v0.5.1. The researcher describes read-only local checks; a negative scan is not proof of safety. Scan or preserve cache evidence before deleting it.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- MotherSphere original technical report and indicator listPrimaryFull original report read through the public GitHub Gist API. Separates own-host/static analysis from commenter reports; lists CDN cache observations, indicators and cleanup corrections. November 4 12:11 GMT revision adds a four-node 11:20 UTC clean recheck, later historical stale-cache observations, older payload indicators and compressed .ldb evidence.
- NIKKE official notice, public embed excerptPrimaryReadable official excerpt acknowledges possible PC script tampering and a November 4 02:30 UTC+9 client fix. Direct X page returned 403; the embed truncates the remainder, which is not treated as read.
- MotherSphere public GitHub Gist API original-content copyPrimaryFull English file content and UTC creation metadata actually read; the same origin as the original report, not independent corroboration.
- WormW original sample analysis and current-asset recheckPrimaryNovember 4 07:14–07:20 UTC recheck found all four known assets clean; documents historical poisoned copies, current hashes and cache limits. Original delivery observations are attributed to MotherSphere and third-party reports.
- WormW full indicator CSVPrimaryOver 100 indicator rows with confidence labels, including historical hashes and ETags, network patterns and local artifacts; shared services and historical indicators need context.
- MotherSphere NIKKE Launcher Check original documentationPrimaryAuthor-described read-only local scanner, optional report writing, checks/verdict limits, release checksums and redaction. Not an independent tool audit or guarantee of a clean host.
- NIKKE Launcher Check v0.5.1 release metadataPrimaryPublished November 4 13:39:38 UTC, with platform assets and checksum file; downloaded executables were not run.