The NIKKE PC launcher security incident means some Windows players need to check their computers. If you ran the launcher after 27 September 2026 at 15:41 (UTC+9), the publisher recommends a security check and steps to protect accounts used on that PC. This is a precaution, not proof that your computer was infected.
You can use a check built into the official client, or follow the publisher’s manual instructions if you’ve uninstalled the game. The important thing is to use the genuine NIKKE guidance, not an unverified cleanup tool. Here’s who should check, how the process works and what the latest security notices actually say.
Who needs to check after the NIKKE PC launcher security incident?
Anyone who launched Goddess of Victory: NIKKE on Windows after 27 September at 15:41 Korea Standard Time should check that PC. That’s 06:41 UTC on 27 September. The advice applies even if you only opened the launcher once.
Players who have used only the Android or iOS versions are outside the scope of the NIKKE PC launcher security incident described by the publisher. If you also used the Windows launcher, however, check that computer regardless of which version you usually play.
The dates are different for a reason. Launcher scripts were tampered with in September, but the publisher says distribution of malware through them began on 30 October. Its advice still covers the wider period starting in September, so don’t assume you’re exempt because you didn’t play on 30 October itself.
How to use the official NIKKE PC launcher security incident scan
Since 5 November, the genuine NIKKE PC client has included a check for malware linked to the NIKKE PC launcher security incident. You do not need to download a separate program from a Discord message or search result.
- Close all browsers, including Chrome, before you open the PC client. The publisher says browser processes can interfere with complete removal.
- Launch the official NIKKE client and let its check run. If it detects the incident-related malware, the publisher says a prompt can appear within about two minutes, including after the lobby loads.
- If a detection prompt appears, read it. The official tool asks for permission to remove the incident-related logs, DLL files and Windows Registry entries it identified.
- Choose the official removal option if you agree to let the client perform that targeted cleanup. Choosing Cancel does not remove the detected items.
- Follow up with account checks after the PC check has finished. Removing a file does not automatically secure credentials previously entered on the machine.
A missing warning means the dedicated check did not find malware associated with the NIKKE PC launcher security incident. It is not proof that a computer has no other infection. If you have concerns, update a reputable antivirus program and run a full system scan. The publisher’s manual also recommends a Windows Security Offline Scan.
What if you no longer have NIKKE installed?
Look for Manual Security Check Instructions for the PC Launcher in the publisher’s official NIKKE news. The guide is intended for anyone who cannot run the client or wants to inspect the machine without using it. Before manual checks, it says to disconnect from the network and fully close NIKKE, the launcher and Chrome.
Parts of the guide involve Windows files and Registry settings, so follow the publisher’s instructions exactly. Don’t guess at folder names or run a PowerShell command copied from a stranger’s post. If you’re not comfortable making system changes, get qualified help rather than trying an improvised cleanup.
Protect passwords, email accounts and access tokens
The NIKKE PC launcher security incident may have exposed account information on a computer before the launcher was fixed. Once you’ve checked and cleaned the machine, change passwords for accounts that were used on it. Do this from a separate device you know is clean, or from the affected PC only after you’ve completed the checks.
Start with the email account that controls password resets, then work through other important accounts and services. Enable two-factor authentication where you can and check for unfamiliar sessions. If the computer stored API keys or access tokens, revoke the old credentials and issue new ones. Those can remain valid even after a normal password change.
If you suspect someone accessed accounts or moved money without permission, contact those services directly and use the official NIKKE customer support channel for incident reports. Never send passwords, recovery codes or private diagnostic logs to strangers offering to investigate for you.
What happened in the NIKKE PC launcher security incident?
According to the official incident timeline, a third party compromised a domain used by the launcher on 27 September. Some launcher scripts were altered, and malware distribution through them began on 30 October. On 4 November, the NIKKE team replaced affected scripts and refreshed the remaining CDN cache to stop further distribution.
In an additional notice dated 10 November, the team said the official launcher could be used normally again, but malware might still remain on PCs exposed before the fix. It also announced more checks on the integrity and origins of downloaded resources, with an update planned for 12 November. The notice does not establish that the planned update has already been installed on every PC.
Fixing the download source stops new distribution through that route. It does not tell you what happened on your own computer before 4 November. That’s why the security check and account-protection steps still matter.
What should you do today?
Run the genuine launcher check if you used Windows after the date above, or follow the publisher’s manual guidance if the launcher is no longer installed. Check important accounts from a trusted device and rotate any stored access tokens. Avoid files promoted as emergency NIKKE malware removal tools from unauthorised sources.
Being in the exposure window doesn’t mean you were hacked. If you find signs of account compromise or malware, use official support and qualified help instead of attempting unverified repairs.
Official publisher source: NIKKE PC Launcher Security Incident and Follow-up Measures.
