Malware Found in Meccha Chameleon Steam Workshop Maps, Discord Server Also Hacked
Meccha Chameleon, the multiplayer prop hunt game that sold 15 million copies in its first month, has been hit by a malware campaign targeting Steam Workshop community maps. Independent researcher Feint traced the issue to maps like "Laser Tag Neon" and "Chroma Grid Arena," which functioned as malicious droppers, secretly installing a Remote Access Trojan on players' PCs and granting attackers persistent remote control. Crucially, players had to actually load and play a map to get infected; simply downloading it was not enough. Developers patched the vulnerability in update 3.1.0, which the studio says makes it impossible for maps to execute unrelated files like malware.
The situation escalated when a systems engineer investigating the malware had their own machine compromised. Hackers used that foothold to bypass Discord two-factor authentication, seize server permissions, and ban all staff from the game's roughly 100,000-member Discord server. The server has since been restored and the hackers removed. Developers confirmed no source code, game files, or Steam developer accounts were accessed. Players are advised to update the game and exercise caution with Workshop content going forward.
Key Insights
- 1Malicious Steam Workshop maps for Meccha Chameleon installed a Remote Access Trojan, but only infected players who actually loaded and played the map, not those who merely downloaded it.
- 2The security flaw was patched in update 3.1.0, which the developer says prevents maps from executing unrelated files like malware.
- 3A systems engineer investigating the attack had their PC infected, and hackers used that machine to bypass Discord 2FA and take over the game's official community server.
- 4Developers confirmed the compromised device had no access to source code, game files, or Steam developer accounts.
- 5Researcher Feint advises ongoing caution with Workshop content, recommending players stick to maps from trusted creators with an established player base.
Comments (0)
Sign in to join the discussion.