NIKKE PC launcher hack: was my PC infected? k2f_chan in debug.log, 4 traces to check, accounts to rotate (2026-11-04)

If the NIKKE PC launcher's debug.log contains k2f_chan, the malicious agent ran on that PC, and the official notice of 2026-11-05 also treats that line as a sign it may have run. Deleting the files is not enough: change every password, session and API key that was on that PC, and do it from a different device.

This is for anyone who has started the NIKKE: Goddess of Victory PC launcher recently and wants to judge their own machine. My Windows PC was actually infected on the evening of 2026-11-03, and it held Claude Code and Codex settings and development API keys. I checked it read-only on 2026-11-04, and the PowerShell script I wrote to look for the same traces is below. Two official notices came out the next day, so this version includes them too. All times are KST (UTC+9).

k2f_chan in NIKKE's debug.log means your PC was infected

My debug.log had a burst of infection markers at 19:25 on November 3. Here is what my read-only check script printed. For the lines that contain the computer name or a UUID, I kept only the line number and time:

== <drive>:\NIKKE\launcher\intl_service\debug.log
size=21872758  LastWriteTime=2026-11-03 20:26:05 (local)
total_lines=120580
-- 'k2f_chan' hits=1
   line 120569: [1103/192510.949:INFO:CONSOLE(1)] "k2f_chan registered", source:  (1)
-- 'lua downloaded to' hits=1
   line 120567  ts=1103/192510.909
-- 'adopted' hits=1
   line 120570  ts=1103/192511.005
-- 'agent started as' hits=1
   line 120571  ts=1103/192511.007

The image is not the raw log. It redraws the check result in line order. Only the k2f_chan registered line is verbatim; the others are the marker strings listed in the public analysis gist.

The prefix [1103/192510.949] means November 3, 19:25:10, in the PC's local time. The last line of the file, 1103/202605, matched the file's last-write time of 20:26:05 KST. The gist takes even a single k2f_chan line to mean the agent ran. By the official manual-check notice, a k2f_chan registered line means it may have run.

The log is at Launcher\intl_service\debug.log inside your NIKKE install folder. You can open it in Notepad and search, as the notice suggests, but mine was 21.9 MB. In PowerShell, one line does it; change the path to your own install folder:

Select-String -Path "D:\NIKKE\Launcher\intl_service\debug.log" -Pattern "k2f_chan" -SimpleMatch

If even one line comes back, the PC was infected. If nothing comes back, this log shows no sign the agent ran. The notice still says that doesn't fully rule out risk and recommends a full antivirus scan. If you deleted or reinstalled the NIKKE folder, this log is gone with it.

Running the launcher in that window doesn't mean you were infected

Since September 27, my log has launcher records on 18 days. k2f_chan appears on only one of them, November 3. Even after the official start of distribution, there were 4 days with launcher records and no load.

Period	Days with launcher records	k2f_chan	Official timeline
9/28 to 10/29	13	0	after tampering, before distribution started
10/30 to 11/2	4	0	after distribution started (10/30 03:52)
11/3	1	1 (19:25:10)	after distribution started

Zero hits up to October 29 is expected, because by the notice that was before distribution began. Why the four days from the evening of October 30 through November 2 are empty, the log alone can't tell. Judge by your own log, not by the dates.

The second launcher on the same PC, NIKKE_GOOGLE, has no records for this period; its log ends on June 13.

The official notice targets anyone who started the Windows PC launcher at least once after 15:41 on September 27. The notice says the mobile version is not affected. If you only play on mobile, you don't need to check.

The gist says Linux via Proton and the Steam Deck are affected too, except that the Chrome-side traces don't appear under Proton. Neither the notice nor the gist covers the Microsoft Store version or macOS.

The NIKKE PC launcher hack started with tampering on September 27

According to the official notice of 2026-11-05, the incident began on September 27. That morning a third party took over insightjs.com, a domain used by some game services. That afternoon, four scripts on the official CDN that the launcher downloads were tampered with.

Distribution of the malware to players' PCs started at 03:52 on October 30, through the tampered scripts. The table below puts the gist's observations into the notice's timeline. I converted the gist's GMT times to KST. Only the 11-03 19:25 row is my own measurement.

Time (KST)	Event	Source
09-27 10:59	Third party takes over insightjs.com, a domain used by some game services	notice
09-27 15:41 to 15:42	Four official CDN scripts the launcher downloads are tampered with (aegis-fix.min.js, images.7fec4c32.js, FeedList.feb647c9.js, vue-bucket.min.js)	notice; file names from the gist
10-24 01:40	First report of the agent running	gist
10-29 00:46	Only the origin server of FeedList.feb647c9.js gets the clean file; some CDNs keep serving the tampered one	gist
10-30 03:52	Malware distribution to players' PCs starts through the tampered scripts	notice
11-03 19:25	k2f_chan registered on my PC	my measurement
11-04 around 00:00	Anomaly detected, investigation starts	notice
11-04 01:11	First public warning on a NIKKE community Discord	gist
11-04 02:04 to 02:23	Three abnormal files replaced (first pass)	notice (the gist says until 02:21)
11-04 03:31	Attacker server stops responding	gist
11-04 07:26	Last sighting of two CDN nodes serving the tampered FeedList	gist
11-04 12:09	CDN cache refresh for the remaining file completed, then rolled out to nodes one by one (second pass)	notice
11-05 08:00	Official PC client starts automatic malware scan	notice

The gist's first report of the agent running (10-24 01:40) is six days earlier than the notice's start of distribution (10-30 03:52). Neither source explains the gap, so the table keeps both times side by side with their sources.

The two notices went up on 2026-11-05 on the official Korean NIKKE site's notice board (Korean). One covers what happened and the follow-up measures; the other is a manual-check guide. I read them at 08:35 that day. I didn't check whether the global site carries English versions, so everything I attribute to "the notice" here is my summary of the Korean posts, not a quote.

For prevention, the notice lists stronger monitoring, integrity checks on external resources, and least privilege. Before the notices, on November 4, both Shift Up and the publisher Level Infinite only told Korean press they were looking into it (Yonhap, TechM, both Korean). Inven Global covered it in English on November 3, before any statement.

Reports differ slightly on the number of tampered files and the start date, so this post follows only the notices and the gist. The gist also lists the attacker's server addresses and an IP blocklist, but I left them out of this post.

What the gist says the agent collects is broad. It includes passwords and cookies saved in browsers and the NIKKE login saved in the launcher. On the developer side it looks at SSH keys, API tokens, .env files and cloud credentials. On top of that come 28 wallet extensions, screenshots of every monitor, and remote command execution.

A read-only script checks all four traces at once

Besides debug.log, the official notice names four traces to delete. The script below reads those four plus the log, and that's all. It deletes nothing, changes nothing, and connects to nothing.

Trace	Location	Notes
Launcher web cache	%APPDATA%\nikke_launcher\tbs_cache	Survives deleting the NIKKE folder; k2f.agent in its leveldb
Chrome persistence DLL	%LOCALAPPDATA%\Google\Chrome\User Data\PlatformExperienceHelper\<64 hex chars>\platform_experience_helper.dll	The PlatformExperienceHelper folder itself is a normal part of Chrome
COM hijack key	HKCU\Software\Classes\CLSID\{E77CC89B-7401-4C04-8CED-149DB35ADD04}	Don't delete the same ID under HKLM
Launcher download log	Launcher\log\tinyget\tinyget.<date>-<time>.log	Only the file that is exactly 205,135 bytes (about 200 KB), per the notice
Temp files	%TEMP%\k2f-bcreds-*, %TEMP%\k2f_screen_*.jpg	Gist indicators outside the four; deleted right after use, so absence proves nothing

Paste the script into Notepad and save it as nikke-check.ps1. Open PowerShell in that folder and run it like this. No admin rights are needed, and -ExecutionPolicy Bypass applies only to this one run:

powershell -NoProfile -ExecutionPolicy Bypass -File .\nikke-check.ps1

Anything the script can't read is printed as [ERROR], and the result line then says the check is incomplete. If it can't find your install folder, pass it with -NikkeDir, pointing at the folder that contains Launcher. The script is ASCII-only with English output, because PowerShell 5.1 reads a script without a BOM in the system code page. Here is the full script:

# nikke-check.ps1 - NIKKE PC launcher compromise (2026-10~11) read-only check
# Reads files and registry only. Deletes nothing, changes nothing, connects to nothing.
# Output is printed to this window only. Indicators follow the public analysis gist
# "NIKKE PC launcher compromise (November 2026)" by MotherSphere and the official
# NIKKE notices of 2026-11-05 (tinyget file size).
# Usage (normal PowerShell, no admin needed):
#   powershell -NoProfile -ExecutionPolicy Bypass -File .\nikke-check.ps1
#   powershell -NoProfile -ExecutionPolicy Bypass -File .\nikke-check.ps1 -NikkeDir "D:\Games\NIKKE"
param([string]$NikkeDir = '')
$ErrorActionPreference = 'SilentlyContinue'
$script:found = 0; $script:errors = 0
function Hit([string]$label, [string[]]$detail) { "[FOUND] $label"; foreach ($d in $detail) { if ($d) { "        $d" } }; $script:found++ }
function Ok([string]$label) { "[OK]    $label" }
function Note([string]$label) { "[NOTE]  $label" }
function Err([string]$label) { "[ERROR] $label"; $script:errors++ }

"NIKKE PC launcher check (read-only)  " + (Get-Date -Format 'yyyy-MM-dd HH:mm')
""

# 1. debug.log : k2f_chan = the malicious agent ran on this PC
$dirs = @()
if ($NikkeDir) { $dirs += $NikkeDir; $dirs += (Join-Path $NikkeDir 'Launcher') }
$un = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
      'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
      'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*'
$dirs += Get-ItemProperty $un | Where-Object { $_.DisplayName -match 'NIKKE' -and $_.UninstallString } |
  ForEach-Object { Split-Path ($_.UninstallString -replace '^"([^"]+)".*$', '$1') -Parent }
foreach ($r in (Get-PSDrive -PSProvider FileSystem).Root) { $dirs += (Join-Path $r 'NIKKE\Launcher') }
$logs = @($dirs | ForEach-Object { Join-Path $_ 'intl_service\debug.log' } |
  Where-Object { Test-Path -LiteralPath $_ } | ForEach-Object { (Resolve-Path -LiteralPath $_).Path } | Sort-Object -Unique)
if ($logs.Count -eq 0) { Note "debug.log not found. Re-run with -NikkeDir pointing to the folder that holds Launcher." }
foreach ($log in $logs) {
  Note ("debug.log: $log  (last write " + (Get-Item -LiteralPath $log).LastWriteTime.ToString('yyyy-MM-dd HH:mm') + ")")
  try {
    $h = @(Select-String -LiteralPath $log -Pattern 'k2f_chan' -SimpleMatch -ErrorAction Stop)
    if ($h.Count) {
      Hit "debug.log: k2f_chan x$($h.Count)" ($h | ForEach-Object { "line $($_.LineNumber): " + $_.Line.Substring(0, [Math]::Min(55, $_.Line.Length)) })
    } else { Ok "debug.log: no k2f_chan" }
    foreach ($p in 'lua downloaded to', 'agent started as') {
      $c = @(Select-String -LiteralPath $log -Pattern $p -SimpleMatch -ErrorAction Stop).Count
      if ($c) { Hit "debug.log: '$p' x$c" }
    }
  } catch { Err "debug.log could not be read: $log ($($_.Exception.Message))" }
}

# 2. Launcher\log\tinyget : tinyget.<date>-<time>.log of exactly 205,135 bytes (official notice, 2026-11-05)
#    Name, size and time only - the file content is not read.
$tg = @($dirs | ForEach-Object { Join-Path $_ 'log\tinyget' } |
  Where-Object { Test-Path -LiteralPath $_ } | ForEach-Object { (Resolve-Path -LiteralPath $_).Path } | Sort-Object -Unique)
if ($tg.Count -eq 0) { Note "Launcher\log\tinyget not found (same folders as debug.log were checked)" }
foreach ($d in $tg) {
  try {
    $m = @(Get-ChildItem -LiteralPath $d -File -Force -ErrorAction Stop |
      Where-Object { $_.Length -eq 205135 -and $_.Name -match '^tinyget\.\d{8}-\d{6}.*\.log$' })
    if ($m.Count) { Hit "tinyget: 205,135-byte log x$($m.Count) in $d" ($m | ForEach-Object { $_.Name + '  (last write ' + $_.LastWriteTime.ToString('yyyy-MM-dd HH:mm') + ')' }) }
    else { Ok "tinyget: no 205,135-byte tinyget.<date>-<time>.log in $d" }
  } catch { Err "tinyget folder could not be listed: $d ($($_.Exception.Message))" }
}

# 3. launcher web cache (survives deleting the NIKKE folder)
$tbs = Join-Path $env:APPDATA 'nikke_launcher\tbs_cache'
if (Test-Path -LiteralPath $tbs) {
  $c = 0; $unread = 0; $ldb = Join-Path $tbs 'Local Storage\leveldb'; $files = @()
  if (Test-Path -LiteralPath $ldb) {
    try { $files = @(Get-ChildItem -LiteralPath $ldb -File -Force -ErrorAction Stop) }
    catch { Err "tbs_cache leveldb could not be listed: $ldb ($($_.Exception.Message))" }
  }
  foreach ($f in $files) {
    try { $c += @(Select-String -LiteralPath $f.FullName -Pattern 'k2f.agent' -SimpleMatch -ErrorAction Stop).Count } catch { $unread++ }
  }
  if ($c) { Hit "tbs_cache leveldb: k2f.agent x$c" $tbs }
  else { Note "tbs_cache exists, no k2f.agent string (compressed .ldb can hide it). Delete it before the next launch: $tbs" }
  if ($unread) { Err "tbs_cache leveldb: $unread file(s) could not be read (close the launcher and run again)" }
} else { Ok "tbs_cache: not present" }

# 4. Chrome persistence: 64-hex folder holding platform_experience_helper.dll
$peh = Join-Path $env:LOCALAPPDATA 'Google\Chrome\User Data\PlatformExperienceHelper'
try {
  $bad = @(if (Test-Path -LiteralPath $peh) { Get-ChildItem -LiteralPath $peh -Directory -Force -ErrorAction Stop | Where-Object {
    $_.Name -match '^[0-9a-fA-F]{64}$' -and (Test-Path -LiteralPath (Join-Path $_.FullName 'platform_experience_helper.dll')) } })
  if ($bad.Count) { Hit "Chrome PlatformExperienceHelper: 64-hex folder with the DLL x$($bad.Count)" ($bad | ForEach-Object { $_.FullName }) }
  else { Ok "Chrome PlatformExperienceHelper: no 64-hex folder with the DLL (the folder itself is normal)" }
} catch { Err "Chrome PlatformExperienceHelper could not be listed: $peh ($($_.Exception.Message))" }

# 5. COM hijack key (HKCU only - an HKLM key with the same id, if present, is normal)
$id = '{E77CC89B-7401-4C04-8CED-149DB35ADD04}'
if (Test-Path "HKCU:\Software\Classes\CLSID\$id") {
  Hit "HKCU CLSID $id exists" ("InprocServer32 = " + (Get-ItemProperty "HKCU:\Software\Classes\CLSID\$id\InprocServer32").'(default)')
} else { Ok "HKCU CLSID $id : not present" }
Note ("HKLM CLSID $id : " + $(if (Test-Path "HKLM:\SOFTWARE\Classes\CLSID\$id") { 'present' } else { 'absent' }) + " (normal either way - do not delete)")

# 6. other HKCU COM entries loading a DLL from AppData
try { $keys = @(Get-ChildItem 'HKCU:\Software\Classes\CLSID' -ErrorAction Stop) }
catch { $keys = @(); Err "HKCU CLSID list could not be read ($($_.Exception.Message))" }
foreach ($k in $keys) {
  $v = (Get-ItemProperty (Join-Path $k.PSPath 'InprocServer32')).'(default)'
  if ($v -match 'PlatformExperienceHelper') { Hit "HKCU CLSID $($k.PSChildName) loads $v" }
  elseif ($v -match 'AppData') { Note "HKCU CLSID $($k.PSChildName) loads a DLL from AppData (check the vendor): $v" }
}

# 7. leftovers in %TEMP% (the agent deletes them right after use - absence proves nothing)
try {
  $t = @(Get-ChildItem -LiteralPath $env:TEMP -Force -ErrorAction Stop | Where-Object { $_.Name -cmatch '^k2f[-_]' })
  if ($t.Count) { Hit "%TEMP%: k2f-* / k2f_* x$($t.Count)" ($t | ForEach-Object { $_.Name }) } else { Ok "%TEMP%: no k2f-* / k2f_* items" }
} catch { Err "%TEMP% could not be listed: $env:TEMP ($($_.Exception.Message))" }

# 8. DLL loaded right now
$p = @(Get-Process | Where-Object { $_.Modules.ModuleName -contains 'platform_experience_helper.dll' })
if ($p.Count) { Hit "platform_experience_helper.dll loaded in: $(($p | ForEach-Object { $_.ProcessName + '(' + $_.Id + ')' }) -join ', ')" }
else { Ok "platform_experience_helper.dll: not loaded in any visible process" }

""
if ($script:found) { "RESULT: $($script:found) indicator(s) found. Follow the removal order, then change passwords from another device." }
elseif ($script:errors) { "RESULT: check incomplete - $($script:errors) item(s) could not be read. Close the launcher and run again." }
else { "RESULT: no indicators found by this script. This is not proof of a clean PC." }
if ($script:found -and $script:errors) { "        ($($script:errors) item(s) could not be read - see [ERROR] lines)" }

The screenshot is from the 2026-11-04 run, so it has no tinyget line; I added that check in the 2026-11-05 revision.

On my PC only debug.log produced hits, three of them. The launcher cache, the Chrome DLL and the HKCU key were all absent. I had already deleted tbs_cache myself before the check. For the other two, all I can say is that they weren't there when I checked. This PC had no Chrome installed, but the gist says the DLL and key can appear even without Chrome.

I listed the tinyget folder separately during the 11-04 check. The lua downloaded to line at 19:25:10 on November 3 pointed to tinyget.20261103-192508-898.log. No file with that name was left when I checked.

The tinyget logs that were left were 69,902 bytes for November 1 and 2 and 90,382 bytes for November 3. There was no 205,135-byte file, the size the notice names, on my PC. I couldn't confirm whether the downloaded file was that file, or why it disappeared.

The HKLM result differed from the gist. The gist says the same CLSID exists under HKLM as a normal key pointing to wpc.dll on every Windows install. On my Windows 11 (build 26300) that key didn't exist at all. Either way, leave HKLM alone.

A loose search for k2f in %TEMP% gives false positives. On my PC it matched five folders, all random names that happened to contain K2F, like <tool>-K2FRwQ. That's why the script only counts names starting with k2f- or k2f_.

I also went through autostart entries separately. Run keys, the Startup folder and scheduled tasks had zero suspicious items, and so did HKCU COM entries loading a DLL from AppData. Defender's detection history was empty too, which means nothing here: Defender was off and a third-party antivirus was registered on that PC.

If you're infected, remove things in this order

The easiest route is the official PC client's automatic scan. According to the notice, from 08:00 on 2026-11-05 the client finds and removes the malware itself. Close every browser, including Chrome, then start the client.

If it finds something, a popup asks whether to delete the logs, the DLL and the registry entries, and agreeing deletes them. If nothing is found, the game just starts with no popup. The notice also says that if a browser wasn't fully closed and the DLL stays behind, it no longer runs.

The manual-check notice calls this feature the ACE security feature. The gist had advised not to start the launcher until a fix was confirmed. Per the notice, replacement of the tampered files finished at 12:09 on November 4 and then rolled out to the CDN nodes one by one.

To remove things by hand, follow the notice's order. First disconnect from the internet and fully quit NIKKE, its launcher and Chrome. Check the system tray icons too, and don't start the launcher again until you're done.

The DLL is locked while it's loaded and can't be deleted, which is why the order matters:

1. In Registry Editor, delete {E77CC89B-7401-4C04-8CED-149DB35ADD04} under HKEY_CURRENT_USER\Software\Classes\CLSID. The same name exists under other paths too, so delete it only at this path.
2. Restart Windows. The gist reports that the DLL stays locked even after closing every Chrome window.
3. Inside PlatformExperienceHelper, delete only the folder whose name is 64 hex characters and that contains platform_experience_helper.dll. Leave the PlatformExperienceHelper folder itself. If no such folder exists now, the notice reads that as the DLL not being installed.
4. In Launcher\log\tinyget, delete the file that is 205,135 bytes and named like tinyget.<date>-<time>.log.
5. Delete the whole %APPDATA%\nikke_launcher\tbs_cache folder.
6. Update your antivirus and run a full scan, then also run a Microsoft Defender Offline scan from Windows Security.

A clean antivirus result doesn't prove removal. The gist says reinstalling Windows is the safest option.

Under Proton, tbs_cache lives inside the Proton prefix. The Chrome DLL and the registry key don't apply on Linux.

Deleting the traces doesn't bring back leaked accounts and API keys

Removing the traces doesn't undo what has already left the PC. So do the account work on a different, clean device, not the infected PC. Here is the gist's recommended order as a table:

Order	What	Why	What to do
1	NIKKE and Level Infinite account	The login saved in the launcher is collected	Change the password, turn on 2FA
2	Email	Recovery path for your other accounts	Change the password, turn on 2FA
3	Discord, Google, Steam, GitHub sessions	A cookie alone logs in without the password	Log out of all sessions
4	Banking, passwords saved in browsers	Saved passwords from Chrome, Edge, Firefox and others are collected	Change the passwords for saved sites
5	API tokens, SSH keys, cloud credentials	Developer credential files and .env are collected	Revoke the old keys and issue new ones
6	Crypto wallets	28 Chrome wallet extensions	Move funds to a new wallet with a new seed phrase

Session logout is the step people skip. Changing a password can leave sessions opened with stolen cookies alive. Hit each service's "log out of all devices" option once.

The notice's two account-protection steps overlap with this table. Changing the passwords of accounts used on that PC covers rows 1 to 4. Revoking and reissuing API keys and access tokens used or stored on that PC is row 5. The notice adds that you should do this from an unaffected device or from a PC that has finished the check.

For damage to accounts outside the game, or financial loss, the notice says to contact official customer support.

Here is what I actually did. I deleted tbs_cache before the check and scanned with Norton 360, which found nothing. I changed passwords and logged out of every session. I revoked my Claude and OpenAI API keys and my GitHub token. Then I formatted Windows. That was the price of not keeping my gaming PC and my work PC separate.

Community-made scanners are going around too. I didn't run any; I looked for the same traces with the read-only script in this post.

Takeaways

If debug.log has a k2f_chan registered line, treat the PC as infected: remove the traces in the notice's order or let the official client's scan do it, then rotate passwords, sessions and API keys from another device. Launching in that window doesn't mean infection by itself, so judge by your own log, and keep in mind that a clean scan doesn't prove removal.

Unverified

The traces before removal: the only trace I deleted was tbs_cache, and I didn't keep a screenshot. I couldn't confirm whether it held k2f.agent, or whether the Chrome DLL and HKCU key existed before. My account of what I did relies on memory. The tinyget.20261103-192508-898.log file that debug.log pointed to was also gone at check time. I don't know whether it was the notice's 205,135-byte file, or when and why it disappeared.

Whether anything actually leaked: no unusual account activity so far is not proof that nothing leaked. The PC-side logs can't show what the agent took. The gist also says remote commands leave nothing in the launcher logs.

Why the agent didn't load on some days after distribution began: zero hits through October 29 is explained by the notice's start of distribution. From that start (03:52 on October 30) through November 2, there was still no k2f_chan for four days. I don't know whether that was the CDN cache or some other condition.

Microsoft Store, Google Play Games and macOS: the notice covers the Windows PC launcher and says mobile is unaffected. Neither the notice nor the gist covers the other versions. The notice's example paths include NIKKE_GOOGLE, but that alone doesn't settle whether the Google Play Games version is affected. I only checked the PC launcher version.

The script on Steam and Proton: the script finds the install folder from the uninstall registry entries and also tries NIKKE\Launcher on every drive. I haven't run it against a Steam install path or under Proton.

Whether the removal order works: the removal order here matches the notice's manual-check steps. But my PC had no HKCU key, no Chrome DLL and no 205,135-byte tinyget file at check time, so I couldn't walk through the steps myself.

The official client's automatic scan: the scan has run since 08:00 on November 5, but I had already formatted that PC and couldn't try it. The detection conditions and popup behavior come only from the notice.

The script's tinyget size check: the 205,135-byte check, added on 2026-11-05, is built only from the size and name pattern in the notice. It has never run on Windows, and I haven't confirmed that it fires on an infected PC.

Other Level Infinite games: other games that use the same launcher components have been mentioned as possibly affected. This post checks only the NIKKE launcher.

Community scanner results: I didn't run the community scanners, so I couldn't compare their results with this script's.

Changelog

Version	Description
1.0	2026-11-05 first English version, based on Korean version 1.1 (read-only check of my PC on 2026-11-04: one k2f_chan line in debug.log, no other traces; two official notices of 2026-11-05: timeline, tinyget trace, client auto-scan, mobile not affected)

AI disclosure: translated and edited with AI assistance (Claude) from my Korean original. Measurements were run with Claude Code under my supervision; I reviewed the result.