A lot of people are panicking about the NIKKE PC launcher, so here's what I'd want someone to tell me.
First, what's confirmed. SHIFT UP has acknowledged possible tampering, and the researcher's report (MotherSphere's) holds up everywhere I could check it.
Second, exposed is not the same as infected. The attack code only reached some launches, and some people who checked found no sign of it. That's why checking matters.
What I'd do right now:
- Close the launcher and don't open it yet.
- Don't uninstall or wipe before you check. Uninstalling deletes the evidence.
- Search debug.log for k2f_chan. A hit means take the serious steps. No hit, or no log left? The guide has calm steps for that too.
Staying calm and checking first is the right call. The guide has the 5-minute check, what each result means, and what's verified vs. not. Written with AI help, and every check is reproducible: github.com/SpringZali/nikke-…
If someone you know is about to wipe their PC, send them this first. If anything here needs fixing, tell me and I'll update it in public.
Just to follow up in case you're talking about my first post: it was written before any official word, and 3 hours later my follow-up said: pause the launcher, the "one PC" line is outdated. The pinned post is the current advice, with the steps. github.com/SpringZali/nikke-…
That's not what this post says. It starts with what's confirmed, then: close the launcher, check debug.log before you uninstall or wipe, follow the guide. I did that myself: checked first, cleared the modified files, then removed the launcher. github.com/SpringZali/nikke-…
Yes, still check that folder: it's a path on your PC, not your browser, and the report says the DLL can be installed even without Chrome. At home, 5 minutes: debug.log first (search k2f_chan). Until then keep the launcher closed and don't uninstall. github.com/SpringZali/nikke-…
Not a disaster: that's GREY (logs gone, can't tell). Two checks still work: the registry key and the Chrome helper DLL folder (section 3). Either one means RED. Either way, change passwords from another device and sign out everywhere. No panic-wipe. github.com/SpringZali/nikke-…
Springz retweeted
i would advice to not run random scripts made by strangers, especially during a moment of chaos, many opportunistic ppl might actually hack your pc's
I have a possible "easy" solution for non-technical fellow #NIKKE PC players.
gist.github.com/neutralnikke…
I've had a few mutuals test it. The script is extremely overly documented due to ensure it's doing nothing sketchy.
Yes, if you chose "Remove everything": that counts as a reinstall and wipes your apps, profile and registry, where the documented traces sit. USB is stricter, but optional here. Changed passwords on this PC before resetting? Redo the key ones now. github.com/SpringZali/nikke-…
Not on that evidence alone. The deciding line is "k2f_chan registered" in debug.log. If it's absent and you found no agent state or DLL folder, the agent likely didn't run (YELLOW): no wipe. Delete tbs_cache, change your NIKKE password to be safe: github.com/SpringZali/nikke-…
k2f_chan in the log means the agent ran, so you're in the RED group: not "good", but not hopeless. The DLL counts too, and clean later tests only mean known leftovers are gone. Change passwords from another device and sign out everywhere; steps here: github.com/SpringZali/nikke-…
Clarification on my earlier replies about SSH keys: that was an unconfirmed community hypothesis, not a finding. No published report shows SSH keys being misused so far. The verified picture: github.com/SpringZali/nikke-…
A security warning inside the NIKKE launcher does NOT prove your PC was hacked.
That warning comes from a page at insightjs[.]org that went up on Nov 3, after the incident was already public. The researcher's report says the page calls itself an independent notice. It shows up when the launcher's modified script can't reach the attacker's server. Block the attacker's address, or have their server go offline, and you see it.
So the warning means one thing: the modified script loaded. That's exposure to the first stage, not proof the remote-control program ran. And no warning doesn't mean you're fine either.
The real check is debug.log. Search it for k2f_chan before you uninstall or wipe anything.
Calm. Check first. Then decide: github.com/SpringZali/nikke-…
If you mean the FATAL MAID event (Jan 29 to Feb 11), that's well before Sep 27, when the tampered launcher files went up. If the last time you opened the NIKKE PC launcher was before Sep 27, you weren't exposed. If it was after, the 5-minute check is here: github.com/SpringZali/nikke-…
Update (Nov 4): SHIFT UP has since acknowledged an anomaly and shipped a client fix; it hasn't confirmed malware or victims. The researcher's report holds up where I could check it.
What to do now: close the launcher and don't wipe anything before you check. The 5-minute guide: github.com/SpringZali/nikke-…
A security warning inside the NIKKE launcher does NOT prove your PC was hacked.
That warning comes from a page at insightjs[.]org that went up on Nov 3, after the incident was already public. The researcher's report says the page calls itself an independent notice. It shows up when the launcher's modified script can't reach the attacker's server. Block the attacker's address, or have their server go offline, and you see it.
So the warning means one thing: the modified script loaded. That's exposure to the first stage, not proof the remote-control program ran. And no warning doesn't mean you're fine either.
The real check is debug.log. Search it for k2f_chan before you uninstall or wipe anything.
Calm. Check first. Then decide: github.com/SpringZali/nikke-…