Meccha Chameleon malware in Steam Workshop maps triggers Discord server hack

Meccha Chameleon Steam Workshop malware Discord hack update 3.1.0

Security researcher Feint discovered that a Steam Workshop map titled “Laser Tag Neon” for the indie hit Meccha Chameleon wrote a batch file to the player’s Documents folder and launched a hidden PowerShell process. The script attempted to download a second‑stage payload from an external server, but the download returned a 404 error and the final payload was never retrieved.

The developers, Lemorion and Haganeiro, confirmed the vulnerability was patched in update 3.1.0 (reinforced in 3.2.0), removing the malicious code and disabling the malware on affected maps. The map was removed from the Workshop afterward.

Separately, a developer’s backup PC became infected while testing the malicious map. Attackers bypassed two‑factor authentication, seized the official Discord server, and banned all staff members. The team restored control within 48 hours and affirmed that the game itself remains virus‑free. Meccha Chameleon has sold about 15 million copies, ranking second in PC game revenue after Fortnite.

Entities

Discord · Feint (security researcher) · Haganeiro · Haganeiro (co‑developer) · Lemorion · Lemorion (developer) · Meccha Chameleon · Meccha Chameleon (game) · Steam (distribution platform) · Steam Workshop

Claims

What the coverage asserts, and how many sources carry each claim.

[● 5 SOURCES] The malicious map was removed from Steam Workshop after discovery. dailyguardian.ae · nationalcybersecurity.com · www.dexerto.com · time.news · www.digitaltrends.com
[● 7 SOURCES] The developers’ official Discord server was compromised after a system engineer’s PC was infected with malware, leading to the bypass of two‑factor authentication and banning of staff. time.news · www.gamespark.jp · game.ettoday.net · gamelevate.com · www.dexerto.com · +2 more
[● 5 SOURCES] The game’s core files are free of malware and virus‑free. time.news · www.gamespark.jp · game.ettoday.net · www.dexerto.com · automaton-media.com
[● 3 SOURCES] A developer’s backup PC infected while testing the malicious map was used to bypass two‑factor authentication on Discord and gain control of the server. time.news · nationalcybersecurity.com · www.dexerto.com
[● 4 SOURCES] Meccha Chameleon has sold around 15 million copies, making it the second‑highest PC game revenue month behind Fortnite. dailyguardian.ae · time.news · www.digitaltrends.com · www.dexerto.com
[● 7 SOURCES] A custom Steam Workshop map called “Laser Tag Neon” for Meccha Chameleon contained code that wrote a batch file to the user's Documents folder and launched a hidden PowerShell process. dailyguardian.ae · time.news · geekzilla.tech · www.gamespark.jp · nationalcybersecurity.com · +2 more
[● 6 SOURCES] The PowerShell process attempted to download a second‑stage payload from an external server, but the download returned a 404 error. dailyguardian.ae · time.news · geekzilla.tech · nationalcybersecurity.com · www.dexerto.com · +1 more
[● 5 SOURCES] The vulnerability in the custom maps was patched in Meccha Chameleon update version 3.1.0 (later reinforced in 3.2.0). time.news · nationalcybersecurity.com · www.dexerto.com · www.gamespark.jp · automaton-media.com
[● 3 SOURCES] Developers affirmed that the Discord hack did not affect the game itself, which remains safe. time.news · www.gamespark.jp · automaton-media.com
[● 5 SOURCES] A custom Steam Workshop map named “Laser Tag Neon” for Meccha Chameleon wrote a batch file to the user’s Documents folder and launched a hidden PowerShell process. dailyguardian.ae · time.news · geekzilla.tech · www.gamespark.jp · www.digitaltrends.com