Game review
Duet Night Abyss
6 / 10
- Developer
- Pan Studio
- Publisher
- Hero Games
- Released
- 19 January 2026
- Platforms
- Windows, iOS, Android
- Genre
- Action RPG
- Monetisation
- Free to play; characters and weapons are earnable through play with no gacha, cosmetic gacha exists for outfits only
- Players
- Online co-op
The short version
Duet Night Abyss is a free-to-play, Warframe-adjacent action RPG that made its name on a bold promise for the gacha genre: no character or weapon gacha at all, everything earnable through play. It launched globally on 28 October 2025 through its own PC launcher, Epic Games Store and mobile storefronts, arrived on Steam 19 January 2026, and built a real, vocal following on the strength of that promise, its story, and its music.
Then, in the space of one month, the game's own launcher was used to distribute actual malware to players — twice. The second incident, on 18 March 2026, installed a credential-and-cryptocurrency- stealing trojan, independently confirmed by security researchers and reported by outlets including Kotaku. This review treats that incident as what it verifiably is — a confirmed security failure, not a review-corpus allegation — and weighs it accordingly against a game that, underneath the incident, still has real things going for it.
Biggest strengths
- Characters and weapons are verifiably earnable through play with no gacha gate, a promise multiple long-term reviewers confirm holds up in practice — cosmetic-only gacha is the sole place real money buys an advantage of any kind
- Story, voice acting and music draw consistent praise even from reviewers who otherwise can't recommend the game, with several comparing the narrative favourably to genre-leading RPGs
- Combat built around freely swapping between melee and ranged weapons mid-fight gives genuine tactical variety, and reviewers coming from Warframe describe the loop as a natural fit
Biggest weaknesses
- The game's own launcher distributed actual malware — a credential and cryptocurrency-stealing trojan identified as Trojan:MSIL/UmbralStealer.DG!MTB — to players on 18 March 2026, the second such incident within a month; this is independently confirmed by security researchers and press coverage, not solely a player claim
- The developer's compensation for the malware incident — ten free cosmetic gacha pulls — was widely seen by players as inadequate given the severity of what happened
- A cluster of long-term, heavily-invested players argue the game's non-gacha promise was kept in letter but not spirit, pointing to a character-duplicate ("I6") system and increasingly steep cosmetic pricing as the actual monetisation pressure that replaced traditional gacha
Who it's for: Warframe and looter-shooter fans drawn to a genuinely non-predatory character-acquisition model and a well-regarded story, who are comfortable with the game's post-incident security posture as it currently stands. Not for anyone who can't accept having run a launcher that distributed real malware to its userbase within the last several months, regardless of the fix.
Our recommendation: Worth considering for the combat, story and its genuinely fair character economy — but read the malware incident section below in full before installing anything, and keep your own security hygiene (updated antivirus, unique passwords, hardware wallet practices) in mind regardless of what the developer says has been fixed.
6 / 10
Introduction
Duet Night Abyss arrived with a pitch that stood out in a genre built on gacha pulls: no banners for characters, no banners for weapons, everything earnable by playing. Developed by Pan Studio for publisher Hero Games, it launched globally on 28 October 2025 through its own PC launcher, the Epic Games Store, and mobile storefronts, building enough of a following in those first months that players logging 300, 500, even over 800 hours before its 19 January 2026 Steam release aren't unusual in this review's sample. That promise earned real goodwill, and this review's research confirms it substantially held up. What happened five months into the game's life, though, is serious enough that it has to lead any honest account of what Duet Night Abyss is right now.
What actually happened, verified beyond the review corpus
On 18 March 2026, an update delivered through Duet Night Abyss's own launcher installed malware on players' computers. This isn't a review-corpus claim this piece is repeating uncritically — it's independently confirmed by security researchers and reported by outlets including Kotaku, which identified the payload as an infostealer trojan (Trojan:MSIL/UmbralStealer.DG!MTB) capable of keystroke logging, screenshot capture, webcam access, stolen browser credentials, cryptocurrency wallet data, and session tokens for platforms including Discord, Telegram, Minecraft and Roblox. It was the second such incident in a month; a February breach had been comparatively minor, altering login screens rather than installing anything malicious. Players discovered the March attack roughly 24 hours after it went out. Pan Studio's public response called it "a serious wake-up call for our team," stated they'd hardened server access and closed non-essential ports, and offered affected players ten free cosmetic gacha pulls as compensation — a gesture this review's sample, and the wider press coverage, treats as plainly inadequate to the severity of what happened.
This review's own reading of the negative sample matches the outside reporting closely. "This game has now been hacked twice with this second time containing actual malware being put on peoples pcs," reads the sample's single most-upvoted review, with 717 votes. Multiple independent reviewers date the incident identically, describe the same delivery mechanism, and several specifically praise the community's own effort to publicise a fix before the developer's official acknowledgement caught up — one reviewer's timeline lists the sequence bluntly: malware installed, silence, community-sourced mitigation, then an official statement that initially downplayed the incident as an "abnormal login issue" before the fuller apology followed.
It's worth being precise about the current state rather than freezing the story at its worst moment. One reviewer, posting 24 April 2026 — over a month after the incident — wrote plainly: "Despite the recent malware and hacking attacks on the game, the game is safe to play nowadays and there has been no further player-affecting malicious cyberattacks after the developers hardened their security." This review's own check of the 100 most recent English reviews found sentiment at 60% positive, meaningfully above the 56.5% lifetime figure — consistent with a real, if partial, recovery in trust since March. None of that erases what happened; it does mean a reader deciding whether to install the game today is looking at a different security posture than the one that failed twice in the space of a month five months ago.
The promise that mostly holds
Set the security incident aside for a moment, because the game underneath it earned its early reputation honestly. The store page's own claim — "Freely farm character fragments and forging materials to unlock your favorite characters and weapons at your own pace. No forced progression, no rigid templates" — checks out against this review's reading of the positive sample. "The gacha is ONLY for cosmetics. You will not be able to pull characters from the gacha," wrote one reviewer with over 130 hours logged before Steam release. Another, an explicit Warframe comparison point that recurs across dozens of reviews: "I enjoy DNA because it's a grinding type of game like warframe. You invest hours (not money) and get characters, weapons, make some builds, getting stronger." Story, voice acting and music draw consistent, specific praise even from reviewers who can't recommend the game overall — one critical review still credits it with "Final Fantasy vibes" and "excellent" music and voice work before pivoting to its complaints.
Where the "no gacha" promise gets complicated
A cluster of the most detailed, highest-playtime critical reviews argues the letter of the no-gacha promise survived while its spirit didn't. Several point to an "I6" character-duplicate system as functionally gacha-shaped even without a character banner attached to it, and describe cosmetic pricing that's climbed steeply since launch. One reviewer's framing is the sharpest version of this argument: "What's impressive is how DNA made a non-gacha game more predatory than actual gacha games," going on to list specific systems — duplicate farming requirements, cosmetic costs — that replaced the removed gacha mechanic with something the reviewer argues is functionally similar pressure by a different name. A separate, equally specific complaint concerns a patch one long-term supporter says fundamentally changed the game's rhythm: "the last major patch before posting this review they effectively turned it into an idle game, requiring no input from the player. The vast majority of the grind is now start mission, then go AFK and check back in 30-60 minutes. This is NOT what I signed up for." That's a notable inversion for this library to record — a player explicitly unhappy that a game became more passive, in a genre where the opposite complaint is far more common.
Final Verdict
Duet Night Abyss is a genuinely hard game to score cleanly, and this review isn't going to pretend otherwise. Judged purely on its systems — combat, story, music, and a character-acquisition model that holds up to real scrutiny as non-predatory — it's a strong entry in a crowded genre, and this review's category scores above reflect that. But no score for this game can honestly ignore that its own update delivery system was used to install real, credential-stealing malware on players' machines twice within a month, that the compensation offered was widely and fairly seen as inadequate, and that recovery — real as it appears to be in recent sentiment — doesn't undo what already happened to players who were affected. If you're weighing whether to install this today, the game itself has real merit and the immediate security picture looks better than it did in March. Whether that's enough given what happened is a judgment this review leaves with the reader, stated as plainly as the facts allow rather than smoothed over either direction.
Pros and cons
Pros
- Characters and weapons are verifiably earnable through play with no gacha gate, a promise multiple long-term reviewers confirm holds up in practice — cosmetic-only gacha is the sole place real money buys an advantage of any kind
- Story, voice acting and music draw consistent praise even from reviewers who otherwise can't recommend the game, with several comparing the narrative favourably to genre-leading RPGs
- Combat built around freely swapping between melee and ranged weapons mid-fight gives genuine tactical variety, and reviewers coming from Warframe describe the loop as a natural fit
- The developer is repeatedly described as responsive and transparent by long-term players, including during the security crisis itself, and posted a direct public apology acknowledging the incident as "a serious wake-up call"
- Recent sentiment (the 100 most recent English reviews, checked five months after the incident) sits at 60% positive, meaningfully above the lifetime figure, suggesting real recovery since security hardening was implemented
Cons
- The game's own launcher distributed actual malware — a credential and cryptocurrency-stealing trojan identified as Trojan:MSIL/UmbralStealer.DG!MTB — to players on 18 March 2026, the second such incident within a month; this is independently confirmed by security researchers and press coverage, not solely a player claim
- The developer's compensation for the malware incident — ten free cosmetic gacha pulls — was widely seen by players as inadequate given the severity of what happened
- A cluster of long-term, heavily-invested players argue the game's non-gacha promise was kept in letter but not spirit, pointing to a character-duplicate ("I6") system and increasingly steep cosmetic pricing as the actual monetisation pressure that replaced traditional gacha
- At least one detailed, highly-invested reviewer describes a later patch shifting the core loop toward extended AFK waiting between active bursts of play, a change they say fundamentally altered what they'd signed up for
- Performance and optimisation complaints recur across the negative sample, described as persistent rather than resolved by any single patch
Screenshots
-
Duet Night AbyssImage: Hero Games via Steam -
Duet Night AbyssImage: Hero Games via Steam -
Duet Night AbyssImage: Hero Games via Steam -
How the review scores each part of the gameWanderer Editorial -
The essentials at a glanceWanderer Editorial -
The short versionWanderer Editorial