Gacha Game Issues Apology After Players Receive Malware with Free Loot Boxes

The developers of Duet Night Abyss, a free-to-play gacha RPG, have issued an apology following a “cybersecurity incident” that took place on March 18, which led to numerous players’ PCs being infected with malware. According to the official statement, this “malicious attack” was propagated through an update delivered via the game’s launcher.

Players first noticed the issue about 24 hours ago, and those whose anti-virus software managed to quarantine the threat identified the malware as “Trojan:MSIL/UmbralStealer.DG!MTB.” A bit of digging reveals that this Trojan is quite harmful, but it’s also relatively old, making it easier for anti-virus programs to detect.

The “Umbral Stealer” is an infostealer virus capable of recording keystrokes and capturing screenshots. Essentially, it aims to extract sensitive information from infected machines, particularly targeting passwords and cryptocurrency. The virus was spread through a patch to the Duet Night Abyss launcher, which was released on Steam at 7:39 am UTC on March 18.

“Even after the initial breach, there have been ongoing attempts to continue the attack and spread misinformation. We strongly condemn these actions. As security is a crucial aspect of a live product, this incident has been a significant wake-up call for our team,” the statement shared on the game’s social media account noted. To further apologize, players will receive “Commission Manual: Volume III*5, Prismatic Hourglass*10,” which translates to ten free random skins.

While the team has mentioned that several “security enhancements” have been put in place to prevent future attacks, many fans remain skeptical. This skepticism is likely due to the fact that this marks the second time Duet Night Abyss has faced a security breach in the past month, with another malware incident occurring through the launcher in late February. However, that previous attack was less severe, seemingly intended more as a warning to the developers, as it simply directed players to play Genshin Impact instead.