A portable Python script that drives Sysinternals Procmon to record and report a program's runtime activity for malware analysis.
eighth80/nikke-hack-checker
A Windows tool that read-only scans a PC for traces of the 2026 NIKKE PC launcher hack and offers optional, opt-in cleanup.
- Stars
- 0
- Forks
- 0
- Open issues
- 0
- Last commit
- 2 days ago
What is it?
NIKKE Hack Checker is an unofficial Windows utility for checking whether a PC was compromised through the November 2026 NIKKE (Goddess of Victory: Nikke) PC launcher hack and for removing leftover traces. The scan is read-only and changes nothing. Fixes run only for items the user checks, and a report is saved before anything is deleted.
The scanner looks at launcher logs and agent download records, launcher storage state, attacker server connection records, malicious DLLs in Chromium-based and Firefox browser profiles, registry COM hijacking entries, running processes with malicious modules loaded, and hosts and firewall blocking. It also covers cleanup of the launcher cache and processes, blocking of attacker domains and IPs, and optional deletion of cookies and site data. The tool does not connect to the internet and does not send results anywhere.
The project is written in Go with no external packages and is built into Korean and Japanese executables from a shared source tree.
Key features
- 01Read-only scan of launcher logs, browser profiles, registry, processes and hosts for known infection traces
- 02Saves a report before any deletion and skips cleanup if saving fails
- 03Fixes only user-selected items and re-validates paths before deleting
- 04Blocks attacker domains via hosts and IPs via Windows Firewall
- 05Optional cookie and site-data cleanup, off by default
- 06Checks 21 Chromium-based browsers and Firefox
- 07Korean and Japanese builds from the same source
Use cases
- Checking a Windows PC that ran the NIKKE PC launcher after the November 2026 incident
- Verifying traces remain after the NIKKE launcher was already uninstalled
- Reviewing and blocking attacker domains on a home PC before rotating credentials
Quick start
- 1
Download nikke_check_ko.exe (or the Japanese build) from the Releases page
- 2
Or build it yourself with Go 1.24+ by running the PowerShell build script
.\build.ps1
Things to know
- Windows only; the tool is built for Windows 10 and 11.
- The executable is unsigned, so Windows SmartScreen or Defender may block it.
- A clean scan is not a guarantee that the PC is safe.
In collections
Topics
FAQ
- What is nikke-hack-checker?
- A Windows tool that read-only scans a PC for traces of the 2026 NIKKE PC launcher hack and offers optional, opt-in cleanup. NIKKE Hack Checker is an unofficial Windows utility for checking whether a PC was compromised through the November 2026 NIKKE (Goddess of Victory: Nikke) PC launcher hack and for removing leftover traces. The scan is read-only and changes nothing. Fixes run only for items the user checks, and a report is saved before anything is deleted.
- Is nikke-hack-checker free to use? What license does it have?
- nikke-hack-checker is open source under the MIT license. Check the license terms before using it in commercial products.
- Is nikke-hack-checker still maintained?
- Actively maintained. The last commit to nikke-hack-checker was on Nov 5, 2026.
- What can I use nikke-hack-checker for?
- Checking a Windows PC that ran the NIKKE PC launcher after the November 2026 incident Verifying traces remain after the NIKKE launcher was already uninstalled Reviewing and blocking attacker domains on a home PC before rotating credentials
- How do I install nikke-hack-checker?
- Download nikke_check_ko.exe (or the Japanese build) from the Releases page Or build it yourself with Go 1.24+ by running the PowerShell build script: .\build.ps1
- Where can I get nikke-hack-checker?
- The source code and installation instructions are on GitHub: https://github.com/eighth80/nikke-hack-checker
Summary generated by AI from the project's README. GitHub stats refresh daily.
Related projects
A UNIX-like reverse engineering framework and command-line toolset for analyzing binaries, disassembling code and debugging programs.
Offline scanner that checks Windows, macOS, Linux computers, Android collections and iPhone backups for traces of known mercenary spyware.
A self-hosted web app that extracts IoCs from raw text and checks their reputation across many threat intelligence services.
Read-only Rust scanner that checks Windows, Linux and macOS machines for traces of the November 2026 NIKKE PC launcher compromise.
A curated awesome-list of security tools, testing apps and jailbreak resources for macOS and iOS.