Hackers used Steam Workshop maps to spread malware in Meccha Chameleon, how to stay safe
Follow UsSome Steam Workshop maps for Meccha Chameleon were used to spread malware.
The developers removed the harmful maps and released a security update.
Players should scan their PCs and only use trusted Workshop maps.
Steam users who enjoy playing custom maps in Meccha Chameleon have been warned after researchers found that some Workshop maps were being used to spread malware. The issue first came to light when players noticed a Command Prompt window briefly appearing while loading into matches with certain community-made maps. A detailed investigation later revealed that one malicious map was secretly writing a batch file to a player’s Windows Documents folder before attempting to download another script from an external server. Although the developers confirmed that the game itself was never infected, the incident has raised fresh concerns about the safety of downloading content from the Steam Workshop.
SurveyMalicious Workshop maps removed after investigation
The first map linked to the attack, Laser Tag Neon, has now been removed from the Steam Workshop. Researchers later identified another map called Chroma Grid Arena, though it has also since been taken down.
The investigation found that the malicious blueprint inside the map created a batch file on the player’s computer when the match started. That file then opened PowerShell in the background and tried to download another script from a remote server.
At first, the second file could not be recovered because the server returned a 404 error. Later analysis showed that the downloaded script installed a Remote Access Trojan, or RAT, allowing attackers to remotely control infected systems.
Also read: OpenAI finds AI agent leaving escape notes for its future versions: Report
Developers confirm the game is safe
The Meccha Chameleon developers reportedly said the game itself is completely safe and was never compromised. According to the post, the incident was limited to a spare testing PC that became infected while engineers investigated the malicious Workshop content.
We now have a full picture of the situation and would like to share the verified details with you.
— Meccha Chameleon (@mecchachameleon) July 25, 2026
To get straight to the point: The game itself is 100% SAFE and virus-free. This incident was strictly limited to a single admin account's Discord being compromised.
What Happened:…
The same malware also allowed attackers to hijack an administrator’s Discord account, bypass two-factor authentication, and take over the game’s official Discord server. The developers have since wiped the affected computer and warned players not to trust fake announcements or links shared through the compromised Discord server.
The studio has also released version 3.1.0, which fixes the vulnerability that allowed malicious Workshop maps to execute malware.
Also read: AC vs dehumidifier: Which one is the best choice for your damp home in monsoon season and why
How to stay safe if you’ve downloaded Meccha Chameleon Workshop maps
Players who only subscribed to a malicious map but never launched it are not believed to be at risk. However, anyone who played an affected map before updating to version 3.1.0 should take extra precautions.
Check the Documents and Temp folders on the platform for unfamiliar batch files. Not only that, but you should also review the startup items and task scheduler for unknown entries.
If possible, then go ahead and perform a full malware scan with reputable security software. Lastly, ensure that you only download Workshop maps from creators that have active community feedback. Also, avoid downloading the new updates from newly created accounts or listings with disabled comments.
