Malware Hidden in *Meccha Chameleon* Custom Maps Triggers Security Alert
A recent discovery has exposed a malware campaign targeting players of Meccha Chameleon, a popular multiplayer game on Steam. According to a report by user Feint on Medium, custom workshop maps specifically "Laser Tag Neon" and later "Chroma Grid Arena" contained malicious payloads designed to execute upon launching the maps.
The malware, described as a dropper, briefly displayed a command prompt window during installation before deploying its payload. While the original infected map was removed, a second malicious map surfaced, prompting warnings from Feint and the game’s developers. Players who subscribed to but did not launch the maps were advised they could safely unsubscribe, as the malware only activated upon starting a match.
Feint recommended checking key directories %USERPROFILE%\Documents\ and %TEMP%/ for suspicious files and scanning for malware. Additionally, users were urged to review Startup entries and Task Scheduler for signs of persistence, a common tactic for maintaining access.
The game’s developer confirmed in a Steam blog post that update 3.1.0 patched the vulnerability, disabling the malware in both maps. However, the incident escalated when the official Meccha Chameleon Discord server home to nearly 100,000 users was compromised. The developers stated they were locked out of the server and had contacted Discord Support for recovery, warning that a new server would be created if the original could not be restored.
The identity of the threat actors remains unknown, and no further details on the malware’s capabilities or distribution have been disclosed. The incident highlights the risks of unverified custom content in gaming communities, even on moderated platforms like Steam Workshop.
Steam TPRM report: https://www.rankiteo.com/company/valve-corporation
"id": "val1785133627",
"linkid": "valve-corporation",
"type": "Cyber Attack",
"date": "7/2026",
"severity": "25",
"impact": "1",
"explanation": "Attack without any consequences"{'affected_entities': [{'customers_affected': 'Players who launched infected '
'maps (number unknown)',
'industry': 'Gaming',
'name': 'Meccha Chameleon (Game)',
'type': 'Video Game'},
{'customers_affected': '~100,000 users',
'industry': 'Gaming',
'name': 'Meccha Chameleon Discord Server',
'size': '~100,000 users',
'type': 'Community Server'}],
'attack_vector': 'Custom workshop maps (Steam Workshop)',
'customer_advisories': 'Players advised to unsubscribe from infected maps, '
'scan systems, and review Startup/Task Scheduler.',
'description': 'A recent discovery has exposed a malware campaign targeting '
'players of Meccha Chameleon, a popular multiplayer game on '
"Steam. Custom workshop maps 'Laser Tag Neon' and 'Chroma Grid "
"Arena' contained malicious payloads designed to execute upon "
'launching the maps. The malware, described as a dropper, '
'briefly displayed a command prompt window during installation '
'before deploying its payload. The game’s developer confirmed '
'that update 3.1.0 patched the vulnerability, disabling the '
'malware in both maps. The incident escalated when the '
'official Meccha Chameleon Discord server was compromised, '
'with developers locked out and contacting Discord Support for '
'recovery.',
'impact': {'brand_reputation_impact': 'Yes',
'operational_impact': 'Malware execution, potential persistence '
'mechanisms',
'systems_affected': 'Player systems (Windows)'},
'initial_access_broker': {'entry_point': 'Custom workshop maps'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Risks of unverified custom content in gaming communities, '
'even on moderated platforms like Steam Workshop.',
'post_incident_analysis': {'corrective_actions': 'Patch to disable malware, '
'removal of infected maps, '
'server recovery efforts.',
'root_causes': 'Malicious payloads in custom '
'workshop maps, lack of '
'verification for third-party '
'content.'},
'recommendations': 'Scan systems for malware, review Startup entries and Task '
'Scheduler for persistence, unsubscribe from unverified '
'custom content.',
'references': [{'source': 'Medium (Feint)'},
{'source': 'Steam Blog Post (Meccha Chameleon Developer)'}],
'response': {'communication_strategy': 'Steam blog post, user advisories on '
'Discord',
'containment_measures': 'Removal of infected maps, patch (update '
'3.1.0)',
'recovery_measures': 'Contacting Discord Support for server '
'recovery',
'remediation_measures': 'Patch to disable malware, user '
'advisories to scan systems'},
'stakeholder_advisories': 'Developers advised players to scan systems and '
'check for persistence mechanisms.',
'title': 'Malware Hidden in Meccha Chameleon Custom Maps Triggers Security '
'Alert',
'type': 'Malware'}