Quick answer: As of November 6, 2026, there is no confirmed evidence that the Delta Force launcher loaded the malicious code that hit the Goddess of Victory: NIKKE PC launcher. The attack worked by tampering with four JavaScript files on Level Infinite's content delivery network (CDN), and the researcher who uncovered it says "no other launcher is known to have loaded the loader." That isn't the same as an all-clear. Delta Force and NIKKE share a publisher and some Tencent software components, Team Jade hasn't published a Delta Force statement, and one unverified player report claims a trace showed up in a Delta Force log. If you also had NIKKE installed, treat that PC as exposed and follow the steps below. If you only play Delta Force, a five-minute log check is a sensible first step, though a clean result is an indicator, not a guarantee.
Key takeaways
- The confirmed victim is NIKKE. Shift Up's publisher confirmed on X that "the PC Launcher's script files may have been tampered with by a third party" and shipped a fix on November 4, 2026 at about 02:30 (UTC+9).
- The tampering lasted over five weeks. Four CDN files were modified on September 27, 2026, and clean copies were on every CDN server the researcher checked by November 4.
- The payload was a remote-access agent, not just a password stealer. While the NIKKE launcher was open, the attacker could run commands, read files and take screenshots.
- Delta Force is not confirmed affected. Inven Global wrote that while the two games "appear to share certain Tencent software components, whether they load the same CDN files has not been confirmed."
- No Delta Force notice exists yet. We checked the official Steam news feed (app 2507950) and playdeltaforce.com news on November 6. The newest post is the November 5 Halloween Update, and it doesn't mention the launcher.
This article applies to Season Reorientation (September 8 – November 9, 2026) and the November 5, 2026 Halloween Update, the latest Delta Force client update at the time of writing. Season Aurora starts November 10. We'll update this page if Team Jade or Level Infinite publishes anything Delta Force-specific.
What happened to the NIKKE launcher?
The NIKKE PC launcher isn't a static program. Every time it opens, it downloads a handful of web scripts from Level Infinite's CDN and runs them inside its built-in browser. According to the independent technical report by researcher MotherSphere, an attacker got write access to that CDN and slipped a short loader into four of those official files: aegis-fix.min.js, vue-bucket.min.js, images.7fec4c32.js and FeedList.feb647c9.js. The report's server timestamps show all four were changed between 06:41:40 and 06:42:03 GMT on September 27, a span of 23 seconds.
The loader quietly reached out to an attacker domain, insightjs.com (with a .org fallback), and used the launcher's own download feature to fetch a file called insight.bundle. That file installed a remote-access agent the researcher named K2F. According to BleepingComputer, which independently examined two of the modified files, the backdoor could "remotely execute commands, browse and download local files, capture screenshots, collect NIKKE account credentials, and steal information stored in web browsers."
Here is the timeline from the public reporting:
| Date (2026) | Event | Source |
|---|---|---|
| Sep 27 | Attacker domain registered; four CDN files modified about five hours later | MotherSphere report, Inven Global |
| Sep 30 | Earliest reported loader lookups on player PCs | MotherSphere report |
| Oct 23–24 | Remote-access agent starts running on infected machines | MotherSphere report |
| Oct 28 | FeedList.feb647c9.js cleaned at the origin server | MotherSphere report |
| Nov 3 | First public warning; three files replaced with clean copies | Inven Global |
| Nov 4 | Level Infinite statement on X; client fix ~02:30 UTC+9; all four files clean on checked servers | BleepingComputer, MotherSphere report |
| Nov 4–5 | Official PC client starts scanning for the malware at launch | MotherSphere report (citing Level Infinite) |
Level Infinite's official statement on X reads: "Accordingly, client fixes and an update were implemented on November 4 at approximately 02:30 (UTC+9). We are currently investigating the scope of the impact caused by this issue, and we will provide further details regarding follow-up measures in a separate notice."
Is Delta Force affected by the NIKKE hack?
Short version: probably not, but nobody official has said so. Here's what each source actually supports.
What points to "not affected":
- The researcher's write-up, which BleepingComputer and Inven both relied on, says the circulating list of "all Tencent games hacked" "goes back to one anonymous 4chan post with no artifact, and no other launcher is known to have loaded the loader."
- The modified files are front-end scripts served to the NIKKE launcher. The agent even stored its state under the NIKKE launcher's own web origin.
- A Delta Force player on r/DeltaForceGlobal who dug through their own install reported finding "nothing related to some malwares that people found in their files," and said a Malwarebytes scan came back clean after Malwarebytes added detection.
What keeps the question open:
- The same report notes that "the same CDN hosts serve other Level Infinite web properties, so the attacker could have reached them, but there is no evidence that they did."
- Inven Global's explainer says the overlap in Tencent components between NIKKE and Delta Force exists, but "whether they load the same CDN files has not been confirmed."
- One comment in an r/Games thread claimed a person found the agent's marker in a Delta Force debug log but not in their NIKKE one. We couldn't verify that claim, and it hasn't been backed up with files.
- How the attacker got write access to the CDN is still unknown, according to the researcher's November 4 update.
One false alarm worth clearing up: an early version of the report listed a temp file called onominan.tmp as an infection sign. The researcher later withdrew that, noting the same file exists in Delta Force installs dated September 20, before the CDN files were touched. If you found it on your PC, it's normal Tencent software, not malware.
How do I check my PC if I play Delta Force?
You don't need special tools for a first pass. The agent leaves a recognizable string in launcher logs, and Delta Force keeps its own launcher logs in its install folder. The official support pages list two PC log locations: DeltaForce\launcher\log and Delta Force\DeltaForce\Saved\Logs.
- Close Delta Force and its launcher completely. Check the system tray, too.
- Open your Delta Force install folder. On Steam, right-click Delta Force, then pick Manage, then Browse local files.
- Search the launcher folder for the text k2f_chan. In File Explorer, open the Launcher folder, type content:k2f_chan in the search box, and let it finish. Then repeat the search for insightjs.
- Repeat in the Saved\Logs folder.
- If you also have NIKKE installed, check Launcher\intl_service\debug.log inside the NIKKE install folder for k2f_chan. That's the exact indicator BleepingComputer cites from the report. Do this before you open the NIKKE launcher again, because the researcher says the updated client "can delete files that show whether the agent ran."
- Run a full scan with an up-to-date antivirus. Malwarebytes added detection names for this malware, per the researcher's notes.
No hits in the Delta Force folders and no NIKKE install? That matches what everyone has found so far, but treat it as a preliminary check, not proof your PC is clean: logs can be missing, rotated or deleted. Keep playing, and read the hardening tips below anyway.
What should I do if I find k2f_chan or played NIKKE on PC?
If either launcher shows the marker, or you opened the NIKKE PC launcher between late September and November 4, assume that machine was exposed. The agent ran with the launcher's privileges, and the report notes a launcher build that requests administrator rights, so anything that account could read could be copied. The optional Chrome DLL component can also keep running after the launcher closes. Inven Global notes the agent scanned 264 file paths and could read saved passwords from Chrome, Edge, Brave, Vivaldi, Opera and Firefox, plus data from 28 browser-extension crypto wallets.
- Disconnect the PC from the internet until you've decided how to clean it, and copy the launcher logs and cache folder first if you want evidence, before reopening the launcher or running cleanup tools.
- Change your passwords from a different, clean device. Start with email, then your Level Infinite / Delta Force login, Steam, Epic, banking and anything saved in your browser.
- Turn on two-factor authentication wherever you can, especially Steam Guard and your email.
- Log out of all browser sessions. Cookies let attackers skip passwords, and the report warns the "collect cookies off" setting "does not mean cookies were safe."
- Move crypto to a new wallet created on a clean device if you kept browser wallets on that PC.
- Consider a clean Windows reinstall. BleepingComputer's guidance for compromised users is to "reinstall Windows, and change passwords and other sensitive credentials from a clean device." The report also cites cases where Microsoft Defender's offline scan missed the optional Chrome DLL component.
- On Steam Deck or Linux (Proton), the report says secrets in your home folder and environment variables should be treated as exposed too.
Can this get my Delta Force account banned?
There's no report of anyone being banned over the NIKKE incident. Still, Delta Force enforcement is strict: Team Jade's G.T.I. Security page lists penalties of up to 10 years and offers an appeal review, and the October 30, 2026 Season Aurora Developer Preview said more than 185,000 accounts were banned during Season Reorientation. Team Jade's enforcement bulletins also mention profiling "masked locations and abnormal system environments", so a stolen login used from another country could plausibly look suspicious.
If you think your login leaked, change your password now, before someone else uses it. If your account does get flagged for activity you didn't do, use the appeal process on the G.T.I. Security page or contact official support through the headset icon on the login screen or service@playdeltaforce.com. Explain the timeline and mention the NIKKE launcher incident. Don't buy "unban" services or use account-recovery sellers; those are scams, and some sell stolen accounts. We cover how Team Jade handles enforcement in our Delta Force ban wave explainer.
How do I keep my Delta Force install safe going forward?
Most of this is standard hygiene, but the NIKKE case shows why it matters even with official software.
- Install only from official stores. Delta Force on PC comes from Steam, the Epic Games Store or playdeltaforce.com. Never download the game, a "fixed" launcher or a missing DLL from a mirror. Our error 126 / tdatamaster.dll fix explains why a loose DLL download is the wrong fix.
- Close launchers when you aren't using them. The NIKKE agent only ran while the launcher was open, and the report describes one machine where it checked in 22 times in 9 hours because the launcher sat minimized in the tray.
- Don't save passwords in the browser on your gaming PC. Use a password manager with a master password instead.
- Keep Secure Boot and TPM 2.0 on. Delta Force requires them anyway; see our Secure Boot and TPM 2.0 setup guide.
- Be suspicious of fake cleanup tools. The researcher flagged a fake "cleanup command" posted in comments under the original report. Only run tools linked from the original write-up or your antivirus vendor.
- Ignore cheat and macro downloads. They're the most common way gamers install malware on purpose, and they're bannable in Delta Force regardless.
Has Team Jade said anything about the launcher?
Not on the channels we checked (the official Steam news feed and playdeltaforce.com news) as of November 6, 2026.
The latest official Delta Force post on Steam is the November 5 Halloween Update, which covers the Season Reservation login event (November 3–12, with Armament Vouchers and the Haavk Guard ASh-12 appearance) and the Home Stretch double-points event (November 6 to November 10 at 00:29:59). It says nothing about security. Players in r/DeltaForceGlobal have noticed: one reply on November 5 read simply, "Still no official statement from the DF Team."
Level Infinite has only spoken about NIKKE so far. After its November 4 statement it published follow-up notices with manual check instructions for NIKKE players, according to the researcher's November 5 update, and none of them names Delta Force. If a later notice names other titles, we'll update this page.
FAQ
Is Delta Force safe to play right now? Based on everything public as of November 6, 2026, yes. No researcher or outlet has confirmed that the Delta Force launcher loaded the malicious NIKKE scripts. Run the k2f_chan log check above as a first indicator for your own PC.
Was Delta Force hacked like NIKKE? There's no evidence of it. The confirmed attack hit four scripts loaded by the NIKKE PC launcher. Reports that "all Tencent games" were hacked trace back to an anonymous post with no proof, according to the researcher who analyzed the attack.
Does the hack affect Delta Force on PS5, Xbox or mobile? No. The attack ran through the NIKKE PC launcher's embedded browser, on Windows or through Proton on Steam Deck and Linux. Console and mobile versions of Delta Force don't use that launcher.
I found onominan.tmp in my Temp folder. Am I infected? That file alone doesn't indicate infection. It was briefly listed as a sign of infection and then withdrawn. The same file exists in Delta Force installs from before the attack, so it comes from normal Tencent software.
Should I uninstall Delta Force? Uninstalling won't undo anything on an infected PC, and there's no sign Delta Force is affected. If you find k2f_chan in any launcher log, focus on changing passwords from a clean device and consider reinstalling Windows instead.
Will I get compensation in Delta Force? Team Jade hasn't announced any Delta Force compensation, and none is expected unless Delta Force turns out to be affected.
More Delta Force guides
- Login failed error codes fix
- Enable Secure Boot and TPM 2.0
- How to report cheaters and get compensation
- Error 126 / tdatamaster.dll fix
Applies to Season Reorientation (September 8 – November 9, 2026) and the November 5, 2026 Halloween Update. Last verified on November 6, 2026. Attack details come from the independent MotherSphere technical report (updated November 5, 2026 14:39 GMT), BleepingComputer and Inven Global. Delta Force event dates come from the official November 5 Steam post. Player quotes are from r/DeltaForceGlobal threads dated November 4–5, 2026.
