Meccha Chameleon Hit by Malware via Custom Steam Workshop Maps

Full text

The devs behind cartoony stealth-'em-up Meccha Chameleon have had to do some serious patching on the game after a couple of custom maps reportedly allowed malware to spread. According to the team, the vulnerabilities have been rectified, including hacking in the official Discord server.

Over the weekend, a player in the community known as Feint published a blog outlining how Laser Tag Neon, a Steam Workshop map in Meccha Chameleon, was allegedly a "malware dropper." The piece was later updated, claiming that Chroma Grid Arena was plagued by the same problems.

"A couple of my friends reported seeing a command prompt window briefly appear while Steam was downloading a custom workshop map," they write on the discovery. "The map was being downloaded through the game's in-game lobby and, once the download completed it immediately began loading for the match."

本日のアップデート3.1.0で記載されているカスタムマップの脆弱性を修正したため適応後は問題ありません。対象のマップについてもアップデート前後でマルウェアが無効化されていることを確認しています。#mecchachameleon #めっちゃカメレオン https://t.co/aGcsXmtKHX July 25, 2026

They add, then, that after looking through the map's files, they realized "it appears to be a malware dropper, despite having passed workshop review." They then go on to list how to spot problems like this, and how the malware works, to help players protect themselves.

The blog has since been updated to note developer lemorion_1224's fixes, which include removing these maps at present. A tweet from the dev says the malware's been disabled after the latest round of patching.

However, another problem emerged when it looked like someone had taken control of the Meccha Chameleon Discord server. "This is literally what your discord looks like right now," someone says in replies , with a screenshot of the server reduced to two channels.

Regular programming has resumed on the server, lemorion_1224 confirming on Twitter a bad actor managed to get into the Discord owner's account. All the admins were locked out at one stage, according to a machine translation of the studio's tweets, but all is well now. I've since joined and can confirm it seems like business as usual.

An update on Steam reiterates this, stating the "malicious mod map issue" is now remedied, and "the game itself is 100% SAFE and virus-free." Another post on Steam adds referring to the Discord situation: "All the hackers have been banned."

Although the fires have been put out, much like in the game itself, treat everything with some caution. There could be repeat incidents, and it may be harder to fix the next time around.

Steam indie hit Meccha Chameleon made more money than any other PC game last month apart from Fortnite, according to new data.