If you are infected Close the launcher, or disconnect from the internet, so the attacker loses access. On Windows, remove the persistence: Open %LOCALAPPDATA%\Google\Chrome\User Data\PlatformExperienceHelper\. Delete any subfolder whose name is a 64-character hex string and that holds platform_experience_helper.dll. Do not delete the whole folder: Chrome creates PlatformExperienceHelper itself for its own platform_experience_helper.exe, so the folder on its own is normal. Delete HKCU\Software\Classes\CLSID\{E77CC89B-7401-4C04-8CED-149DB35ADD04} if it exists. The same CLSID also exists under HKLM on every Windows install, pointing to wpc.dll (WindowsParentalControls). Leave that one. Only the HKCU copy is malicious. Reinstalling Windows is the safest option, because the attacker could run any command while the agent was active.
kek nice 4th anniversary celebration
>>750897164it wasn't just Nikke this is the entire list if you got hacked.
>>750897164Lmao, deserved for all the viral marketing they did with that thing.
YESSSSSSSSSS. Total Gachafag Death!
Funny it's all Tencent shit.Wuthering Waves is oddly missing
>>750897584It’s all a bunch of cheap mobile shit affected. WuWa as much as I dislike it has some actual quality to it.
>>750897345Aren't those all mobile games? Are only people who installed them on PC fucked?
KEKAROOOOOO NIKKERS KYS
>>750897967if you have any of the launchers you are fucked. So if you had it running in the background then it got installed. Check by looking for this %LOCALAPPDATA%\Google\Chrome\User Data\PlatformExperienceHelper\if you have platform_experience_helper.exe in the folder you are fucked.
all gachaniggers deserve this
dns hijack
>>750897164A fitting punishment for the insects that play gachashit.
>>750897164mobilefags status?sucks that this happened to the pcfags
>>750897164Guess this was the incentive needed to finally fully uninstall the game since I stopped playing before summer. >>750897967>Are only people who installed them on PC fucked?Yes.
>>750897345>delta forceDamn I almost reinstalled this shit last weekIt's a good thing that I'm such a lazy fatass I didn't bother
>>750898415it seems Mobile is safe. it's the launcher that got hacked.
>>750897164>only wincucks affectedI've only played Nikke via mobile only since it doesn't work on Linux.Linux saves the day yet again!
>>750897164Never played that gatcha garbage.Post more doro
>>750898529"Linux and Steam Deck (Proton)Proton does not protect you.The automatic scans look for Windows paths, so they find little in a Proton prefix. On the machine analyzed here, the only target present inside the prefix was the NIKKE launcher data.The remote commands are a different matter. Wine maps your Linux home folder and / as drive letters (Z: at least). It also passes your environment variables to the game, and the agent reads all of them. With exec, ls, cat and download, the operator can read anything your Linux user can read: ~/.ssh, browser profiles, shell config files with API keys, password stores and documents. The Windows Chrome persistence does not apply on Linux, but treat every secret in your home folder and environment as exposed."
>>750898589
>>750897164I'm probably fine since I'm many versions outta date, but thanks for the tip. I'll kill it when I get home from work
I don't know what nikke is and my doro folder has over 200 files
>>750898675
>>750898668I was under the impression the anticheat prevented Nikke from even running on Linux to begin with, proton be damned. So I never even tried.
>>750897164Shill thread.
>>750898759You need pump those numbers
>>750898868In your pic what part was mentioned?Retarded cuck.
>>750898961Snoys are all Nikke shills and vice versa
>>750897164
>>750897345>all gachashitAnd nothing of value was lost
Doro
wtf i was juist about to install nikke
>>750897164Persona Collab Curse status?
>>750897164>Google chromeWho the fuck uses that browser these days? How does the hack affect you if use something else like Firefox or brave?
thank you for install platform experience helper saar we'll very proud to offer Finest service to help your gaming experiences
>>750899185I don't think it has anything to do with Chrome. It's just hiding there to look legitimate.
It's great that the launcher forces admin permissions too right?
>>750899185Hack is across every browser, I think. I saw Chrome/Firefox/Brave/Edge specified.
I just wanted to play my misery porn story jiggly butt game
>>750897345Wait PUBG mobile has a PC client? When the game literally already exists on PC? I'm confused.
>>750897164>Tfw i play on my phonerolf lmao
>>750897345>Dune I have this on my phone, am I going to get hacked?
>>750897164Welp. Good thing I didn't install it on my pc first. Tried it on mobile because of the anniversary but the gameplay is garbage and so are the girls. They look fucking trash whores you'll find at the corner.
>>750899440only PC launcher. if you have the PC launcher auto updating you are hacked. it got pushed from their servers.
>>750897584It's Level Infinite published shit, not Tencent as a whole
>>750899005This isn't working like that.
>>750897345Glad I don't play any of that garbage
>>750898887Aesc
>>750899294Brute
>>750897345>Will Smith Zombie GameHoly shit I forgot about this.
>>750899582
>>750899542>>750899457>>750899480>>750898887>>750898825Hello turdworlders.
huh? i dont have that folder in my google\chrome\user dataand i pirated dune awakening kekguess its mobile only for nikke now lol
>>750899606A shitty clone of the "I'm legend" movie (Both was super shit)(Those fuckers really butchered the book what the movie was made of.)
>>750899686>turdworlders*Miss*
>>750899605>doctors replaced the good eye first
My money is on Chink cheaters hacking the game cuz they got banned in the recent purge that shiftup has been doing these last months.
qrd?
>>750899939quick round doro
>>750899847>>750899776>gets dmcad out of existence So much for your based company
>>750899939>qrd?
>>750899939Everyone who used the Windows version of Nikke got all of their passwords stolen because someone who had admin access at Shift Up added "steal all my passwords.exe" to the program's real updater
>>750899939https://gist.github.com/MotherSphere/d6c049a09ba8ac3085c51ee9df24a4e5
>>750899939Chinks hacked the PC launcher to upload a malicious .dll and if you check the debug.log file in your Nikke folder and its got k2f_chan you might be gigga fucked.
>>750899909actual genuine obsession>the multiplayer games that have always had regular banwaves must have surely just caused china to ruin my day!
All of the Chinese Spyware fears finally came home to roost.
>>750899939reg query "HKCU\Software\Classes\CLSID{E77CC89B-7401-4C04-8CED-149DB35ADD04}\InprocServer32" in powershellIf it returns the message "ERROR: The system was unable to find the specified registry key or value.", you are probably alright. If it points to platform_experience_helper.dll, you are hit.
>>750897164if i last downloaded the game 5 months ago and uninstalled it around the same time am I good? I don't have anything in the platformexperiencehelper folder
>>750900190>>750897584Is PoE2 safe?
>>750900018*Sucking the Jews mutilated dick that hard*
>>750900081>The agent is a remote-access tool controlled by the operator. It does not only run a fixed stealing routine. While the launcher is open, the operator can send these commands:>`exec` | Runs any program or shell command and returns the outputlel gachafags getting what they deserve for once.
>>750897164there's nothing there
>>750900342Turdworlder. He’s making fun of the people that DMCA’d them. It really sucks that I have to share this site with you “people”. You ESLs can barely speak proper English
>>750900301Everyone who booted the game between September 27th and November 3rd is fucked
>>750899605Too sad
>>750900704Relax, doro eyes grow back. She'll have ten more within a month.
>>750900704Here some positive
>>750900704
>>750899605UhWrong eye sideAislop still shit as always
>>750899605why does Doro have a tail?
>>750900973Why wouldn't have?
>>750901075
>>750901302
>>750900918
>>750898868>Shill thread.How is saying that your product has malware a shill tactic? Fucking retard schizo
>>750901481You're replying to a bot, you retard.
Doros been corrupted bros it’s over
>>750900887
>>750901371>when you realize that the Doro on the bottom is a sex doll.
>>750901463Nice feet
>>750901704>If it's works, then it's works
https://github.com/whykusanagi/nikke_malware
>>750901857
I don't understand why would only SOME pcs be infected
>>750902058the whole thing gets executed through the tbs_browser in the launcherIf you blocked that before Sept 29 you should be fine
>>750902058some people blocked the tbs browser because it ate resources so the thing never got downloaded
>>750897164>mfw dropped this shitty daily chore simulator months agoIt already was giving me plenty of reasons to never ever touch it again, as if I needed yet another one.
>>750897164Thanks you Doro
Just found this in my registry files. Don't take your eye off it.
>haven't launched that shit since late augustthank fuck
>>750897345I have nikke downloaded on my PC but I havent touched it in months, am I still fucked?
>>750902894What is it?A Doro for ants?
>>750903061uninstall to be safe.
>>750897345thank goodness I'm almost completely immune to gacha
>>750903404Almost?
will this EOS Nikke?
>>750897584Level infinite, not Tencent.Thats why wuwa, fortnite, lol, etc are fine
>>750903846NahBut after the last few months full of drama this will probably kill 20% of the playerbase
>>750902294>>750902362I'm infected for sure then I never blocked shit
>>750897164Doro WTF why are you hacking people now?
>>750903997follow this, or check the nikke disc*rd for more info>>750901919
>>750903846'fraid so
Dorothy...why did you do this?
>>750904140
>>750903891But the hack came through the tbs browser on the launcher which is the Tencent Browsing Service process. So technically its also tencents fault.
>>750904140noshe did it/would do this 100%bitch corrupted the pc client
>vibecoded horseshit aislop game by a piece of shit company gets hackerHahahahahahaha dumbfucks
>>750904341good morning sir
>>750897164Play chink gambling machines, get chink rootkits>but nikkgger is koreanIt's all the same slop
>>750897895Wuwa looks pretty and thats it. Trash on everything else.
>>750904384What's up
>>750904484what this mean?
>>750904484nothing much, how about you saar?
>>750903706I am dutybound to support the megucas
>>750904465I wish.
>>750897164>>750904460>always joked about not wanting to install chink/gook rootkits on my pcVindicated.
>>750904608Truth hurts.
>>750904738I really wish you weren't wrong though.
>>750904140For Shits & giggles
>>750904947The wagie life are pure hell.
>>750897164Not a gachafag, is there anyone that has found the payload or is this just some literal who updootfarming by spreading lies?
>>750904140Revenger for her food stall
>>750897164Good thing I keep my gacha consumption to creatures only.
why can't they do silly shit like what the hackers did with blue archive
Catbox uploads are paused and I can't sound more doros
>>750905283This is everything about it.https://gist.github.com/MotherSphere/d6c049a09ba8ac3085c51ee9df24a4e5They uploaded it through the video that plays in the launcher.
>>750899686Hellooooo reddit
>>750905283If you've been paying attention to the gacha space lately, you'd notice that there have been several successful hacks on all sorts of different games. They all seem to be the same as well. The hackers take control of the CDN, and somewhere, they add their malware for every user to download.
>>750905457those BA hackers were legends
hacks back in the day were way less fucked, like it might brick your PC but thats it. Now one wrong database hack or you click one link and your whole life is fucked.
>>750905760>If you've been paying attention to the gacha space lately
>>750900525Wait, it took that long for people to notice shit was compromised?
>>750905283It's a real payload. The tl;dr: attacker(s) got infected files onto the company's CDN somehow, infected the launcher (which apparently, conveniently runs elevated) and uses an agent / .dll with Chrome to gain persistence even when the launcher isn't running. The malware capabilities include "command execution, file access, screenshots, theft of passwords, browser cookies, tokens, SSH keys and crypto wallets". Anybody who used the PC launcher at any point in the past month (apparently since Sept 27th?) might be hosed. Glad I don't play this particular flavor of chinkshit.
>>750905943The payload only recently started transmitting to catch as many people as possible who logged in for the anniversary event
>>750905943Apparently the agent didn't become "active" until Oct 24th, but the CDN/launcher was infected since Sept 27th.
>>750905943when you're that big and have thousands of employees, who would really think twice about some loose dll in the servers?
>>750902294Why do people still use the internet when shit like this is so common now?
>>750906264because you are forced too. Good luck finding a job or opening a bank account without the internet and a email.
>>750905457I actually wonder what became of the Koyuki hacker. Here's to hoping Nexon didn't rape him too hard.
>>750897164It's true that El Doro is evil now?
>>750906758She was for like 5 minutes. https://www.youtube.com/watch?v=hQC9H3gkSZo
Do I have to delet my doro folder also?
>>750906942Every single doro carries malware
>>750897164>Steals your girl >Steals your data Can anything in South Korea stop this man?
>>750903938Any rundown on said recent drama?
>>750897164>uninstalled it during a gay anime event last year>had a dream about Guilty last nightSorry guys, I brought this on you.
>>750907178Mostly just story related bitching.
>>750907178the top 1% got banned cause they were using cheats on the leaderboard.
>>750907039Good >>750907079
>>750907178a bunch of chink whales playing on the na and eu servers got banned for cheating, account piloting, and using private servers to play raids earlythey've been bitching and moaning about it on social media, further implicating themselves and leading to more banseveryone else is laughing at them
>>750907178top rankers of competitive content were banned / warned they were using exploits / personal servers / macros and other shit that basically ruined everyone's funI wouldn't be surprised if all of this shit is related to them since they were mostly chinks and the virus itself was added to the launcher shortly after the bans started happeningBut I'm just schizposting on that
I don't get it, isn't this a legit site?
>>750907835I saw them posting long bullshit posts on twitter about them quitting the game. Like they were stepping down as president of a company or something. Fucking fags lol.
>>750907869Timeline (According to the Original Research) September 27: The expired domain insightjs.com was re-registered. October 6: The domain received its first SSL certificate. October 29: The malicious program was compiled. October 30: The website homepage was replaced with a fake "InsightJS" service page. November 1: The original researcher became infected.
>>750908118vibesloppers found out it goes much deeper
>>750898103I had nikke running but did all the checks and none of that shit popped up, uninstalled and checked againmy luck stat has always been high I guess
>>750902294I'd still double check just to make sure
>>750898103it's .dll not .exe>>750908209if you had tbsbrowser.exe blocked in your firewall settings prior to september then you're safe (which you should've done anyways since tencent's gay launcher eats ram and cpu like crazy)
>>750897345>all sloplol
>>750908362Maybe I have before, but yeah I don't even have the platform experience helper folder so I guess I did long ago
welp time for No Nikke November.
>>750907507>>750907835even if it's true i won't be shocked
>>750897164>ShiftUp are massive AI fags>get hacked by ClaudeKOJIMAAAAAAAAA
>>750908697
>>750908697Did you rike it?
>>750903061Anyone who hasn't run the launcher since October 31st is safe.
>>750908819>>750908943you did it again kojimbo, you madman
>>750908997September 27- till today. he could have infected your computer but it didn't run until today.
>>750906264>just don't use the internet lol
>>750897345>arena breakpointOh fuck i played this a while agoAm i fooked
>>750897164KEEEEK
>>750909303How long ago, anon?
>>750897164Total tbsbrowser death
>>750909450I'll have to hop on my pc later to lookUhh maybe three months ago. Maybe 2
Swear to God the new normal will be having a separate computer for gaming, one for browsing, and one for storing files
>>750909572you aren't doing this already?
Wow i really love it how every fucking month another fucking cybersecurity vulnerability or hack hits another fucking company or someshit so i have to reset all my fucking passwords again
>>750909572>the humble solar flare
>>750909547Assuming it was before September 27th, you should be (relatively) safe. You should still uninstall that shit asap though.
>>750909742kekit will get worse before it gets worseJUST WIPE THE INTERNETLET ME BE FREE
>ban chink hackers>chink hackers respond by turning your launcher in to a chink malware distributor
>>750897345AI status?
supposedly only chink crypto wallets got anything stolen from them so farwe know it's a chink in china from the domain info
>Haven't played or even opened the launcher since Goddess FallThank god, immediately uninstalled that shit.Goodbye Nikke, too bad that I will now never get Leviathan whenever they release her.
>>750911123the 4Beasts squad got added to the filesSo they are coming soon
> https://nikke.gg/how-to-check-if-your-pc-is-safe-from-nikke-infection/I followed this guide and it said my PC was clean. I only logged in sometime last week, and apparently the malware was delivered in the past 48 hours. I only use firefox, so there wasn't a chrome folder in my appdata/local. Did I dodge the bullet? I really need to stop playing these shitty gachas. Fuck.
