nikke_malware v1.3.10

• New finding, Payload file: the stealer's downloaded program, still on disk in the launcher's log\tinyget folder. It's found by the name debug.log gives it (lua downloaded to ...), or as k2f.lua for the October version. The report records its size and SHA-256, which identify the stealer version. It holds no record of what was sent.
• -Remove quarantines it (moves it into the report's quarantine folder, renamed .quarantine) instead of deleting it, so it's kept as evidence. Real downloader logs are never moved.

Download: nikke_malware-kit.zip below, then open START-HERE.txt.

nikke_malware v1.3.9

• -UninstallMonitor no longer reports "removed" when it failed. If Windows refuses (the monitor was installed from an admin window), it retries as administrator, then checks the task is really gone and says how to delete it by hand if not.

Download: nikke_malware-kit.zip below, then open START-HERE.txt.

nikke_malware v1.3.8

• Second attacker IP 89.126.250.172 (from the public write-up) added to the connection check, -Block and the IOCs.
• An HKCU Parental Controls registry key with an empty value is now flagged SUSPICIOUS, and -Remove deletes it (after the usual backup). That's what the stealer's own uninstall leaves behind; only the HKCU copy is ever malicious.
• Docs: the machine-wide (HKLM) Parental Controls entry exists on most Windows installs, but not all. Leave it alone either way.

Download: nikke_malware-kit.zip below, then open START-HERE.txt.

nikke_malware v1.3.7

• Docs: details from the first discoverer's Korean post (testimony, not forensic). The agent can decrypt the NIKKE launcher's saved login (creds, psd.dat), so the NIKKE / Level Infinite account moves to #2 in the change list. It can also delete the launcher's TinyGet logs (payload_cleanup), so missing logs don't mean clean. New FAQ entry: League of Legends stuck on the logo (Vanguard blocking the unsigned DLL). The checker's closing advice now lists the NIKKE account after crypto wallets.

Download: nikke_malware-kit.zip below, then open START-HERE.txt.

nikke_malware v1.3.6

• Extended signal: leftover agent temp files. The agent copies each browser database to %TEMP%\k2f-bcreds-<unix time>-<n>.db to read it, and writes screenshots as k2f_screen_*.jpg, deleting both straight away (per the public code teardown). They're only left behind when the agent is interrupted. Leftovers were reported from a Japanese-locale PC (screenshot only, not forensic evidence), where the separators didn't render clearly, so the check now matches any separator between the name parts. -Remove deletes them. A clean result here proves nothing, because the files are normally gone within seconds and Storage Sense can clear the rest.
• CI: a Windows test checks hyphen, underscore and space spellings.

Download: nikke_malware-kit.zip below, then open START-HERE.txt.

nikke_malware v1.3.5

• Google Play build of the PC launcher: the checker now reads its cache at %APPDATA%\nikke_launcher_google as well as %APPDATA%\nikke_launcher, and -Remove clears both. Before, the agent's saved state and the cached loader were missed on that build (#23).
• Saved launcher logs: a copy of debug.log placed next to Run-Check.cmd (in scripts, or one folder up) is now checked too. For people who saved it before uninstalling NIKKE (#17, #22).
• README FAQ: saved debug.log, the Google Play build, the "-File parameter does not exist" error, and browser sync (Brave, Chrome, Edge).

Download: nikke_malware-kit.zip below, then open START-HERE.txt.

nikke_malware v1.3.4

• Fix: false INFECTED from insightjs.org. That domain now belongs to a third party running a warning page on Cloudflare, but the checker still treated whatever it resolved to as the attacker's server, so any connection to that shared Cloudflare address was flagged. Only insightjs.com addresses and the known C2 IP count now.
• Fix: -Block no longer firewalls insightjs.org's Cloudflare addresses, which could break unrelated sites. It stays in the hosts sinkhole.
• A closed connection (TimeWait, or no owning program) to the C2 is now SUSPICIOUS, not an active infection.

Download: nikke_malware-kit.zip below, then open START-HERE.txt.

nikke_malware v1.3.3

• Fix: -Remove could leave the launcher cache in place without saying why. It now closes every NIKKE launcher process (tray icon, updater, tbs_browser helpers) before moving the cache, and prints the error with next steps if the move still fails.
• -Remove now warns not to reopen the launcher yet, since some CDN servers were still serving the modified file on Nov 3.

Download: nikke_malware-kit.zip below, then open START-HERE.txt.

nikke_malware v1.3.2

• README: simpler FAQ for non-technical users (mobile and PC only; NIKKE has no console version).
• README and START-HERE.txt: disclaimer (no warranty, no guarantee of detection, not affiliated, back up before removal).

Download: nikke_malware-kit.zip below, then open START-HERE.txt.

nikke_malware v1.3.1

• Timing corrected: another victim's logs show the agent starting on Oct 23, so the stealer was handed out from late October, not Nov 1.
• New indicator: a fourth loader key, l.js?f=vue, found in a victim's launcher cache.
• Launcher-log finding now lists when the agent started as plain dates. It no longer prints raw log lines, which contain the PC name and the agent's per-victim ID that people were posting in screenshots.
• DNS cache check no longer flags lookups that returned no address, or names the hosts file already blocks (false SUSPICIOUS after -Block).
• Clearer next steps after a WAS INFECTED or SUSPICIOUS verdict.
• Fix: with more than one NIKKE install, launcher_agent_lines.txt and payload_downloads.txt kept only the last install's lines. They now hold one block per install.
• Fix: renamed installs (for example Games\NIKKE_GOOGLE\launcher) are found by folder name, not only through uninstall entries.
• New UNKNOWN verdict when no NIKKE install is found: uninstalling deletes the launcher logs, so a clean result there can't rule out a past infection. It used to say CLEAN.
• README FAQ for non-technical users.
• Docs: full Oct 23 - Nov 2 timeline from a three-install PC; the Oct 23 start used an earlier payload build.

Download: nikke_malware-kit.zip below, then open START-HERE.txt.