Meccha Chameleon malware fix and Discord hack clarified by developers
Security researcher Feint identified a malicious Steam Workshop map for the indie hit Meccha Chameleon. The map, Laser Tag Neon, wrote a batch file to players’ Documents folder, launched a hidden PowerShell process and attempted to download a second‑stage payload from an external server (the download returned a 404 error). The map was quickly removed and the vulnerability was patched in update 3.1.0 (later reinforced in 3.2.0), disabling the exploit for all users.
In the same week, the game’s official Discord server was compromised. An engineer’s PC, infected while testing the malicious maps, was used to bypass two‑factor authentication, seize admin accounts and ban the development staff. The developers, Lemorion and Haganeiro, assured the community that the game itself contains no virus or malware and are working with Discord support to restore the server. They advised members to temporarily leave the Discord channel.
Meccha Chameleon has sold roughly 15 million copies, making it the second‑highest revenue‑generating PC title behind Fortnite in June 2026, underscoring the wide impact of the security incident.
Entities: Feint (security researcher) · Haganeiro (co‑developer) · Lemorion (developer) · Meccha Chameleon (game) · Steam (distribution platform)
Claims
What the coverage asserts, and how well corroborated each claim is across sources.
- [● 3 SOURCES] The malicious map was removed from Steam Workshop after discovery. (multiple articles)
- [● 5 SOURCES] Developers state the game core files are free of malware and virus‑free. (multiple articles)
- [● 7 SOURCES] The game’s official Discord server was hacked, with admin accounts taken over and staff members banned. (multiple articles)
- [● 3 SOURCES] A developer’s backup PC infected while testing the malicious map was used to bypass two‑factor authentication on Discord and gain control of the server. (multiple articles)
- [● 7 SOURCES] A custom Steam Workshop map called “Laser Tag Neon” for Meccha Chameleon contained code that wrote a batch file to the user's Documents folder and launched a hidden PowerShell process. (multiple articles)
- [● 6 SOURCES] The PowerShell process attempted to download a second‑stage payload from an external server, but the download returned a 404 error. (multiple articles)
- [● 4 SOURCES] Meccha Chameleon has sold around 15 million copies, making it the second‑highest revenue‑generating PC title behind Fortnite in June 2026. (multiple articles)
- [● 4 SOURCES] The vulnerability in custom maps was patched in Meccha Chameleon update version 3.1.0 (later reinforced in 3.2.0). (multiple articles)