Multiple Meccha Chameleon Workshop Maps Spread Malware as Discord Was Hacked

Joining a public lobby in Meccha Chameleon briefly carried a risk no player could see from the map screen. Two Steam Workshop maps, Laser Tag Neon and Chroma Grid Arena, contained hidden code that could install malware after a match started, turning the game's easy custom-map downloads into a way of reaching Windows PCs.

The known maps have been removed, and update 3.1.0 closed the weakness that allowed them to run code outside the game. The base game was not infected, but the response became more chaotic when the official Discord server was taken over while the team was investigating the problem.

The first warning came when players saw a command window flash as a custom map loaded. The Workshop files looked like normal Unreal Engine assets, but one hidden Blueprint created a batch file in the user's Documents folder, opened PowerShell in the background, and contacted an outside server for another download.

That second download was later recovered and identified as a remote access trojan. Instead of stopping after one suspicious script, the malware could give the attacker control over an infected computer and stay active after the match ended. The attack only started when the map was launched, so subscribing without playing it did not trigger the code.

Meccha Chameleon made the threat harder to notice because players can receive Workshop maps through multiplayer lobbies. Someone joining a room may download the selected map automatically and enter the match without studying its Workshop page first. New uploader accounts, disabled comments, and maps with no established player base became important warning signs after the attack was uncovered.

Version 3.1.0 changed how custom content can interact with the system, blocking Workshop maps from using the same method to write and run files outside the game. The two identified maps were also removed or disabled, stopping the known attack from working again through those uploads.

The incident did not begin inside the normal Steam download for Meccha Chameleon. The infected computer used during the investigation was a separate testing machine that did not have access to the game's source files, and it was wiped after the breach. Claims that the main game update secretly carried the malware were not supported by the evidence.

Players should still make sure the latest version is installed before returning to Workshop lobbies. Anyone who launched one of the affected maps before the fix should run a full malware scan and check for unfamiliar files in Documents or temporary folders. Strange startup programs and scheduled tasks also deserve attention because they can help an infection return after a restart.

While the team was testing the malicious maps, a system engineer's computer was infected and the attacker gained access to their Discord account. The server's permissions were changed, staff members were banned, and the developers lost control of a community space that players were using for updates during an active security problem.

Messages and links inside the compromised server could no longer be trusted, including claims about fake patches, replacement servers, or problems with the official update. Players were told not to follow instructions posted there while Discord support worked on recovery. Steam announcements became the safer place to check what had actually been fixed.

The attack exposed a weak point in the way community maps move through multiplayer games. Workshop support helped Meccha Chameleon grow quickly, but automatic downloads gave bad uploads a chance to reach players before reviews or warnings appeared. Easiest lobby information, stronger map checks, and trusted creator tools would make that convenience safer in future updates.