A rough weekend for one of Steam's biggest hits of the year. MECCHA CHAMELEON, the indie prop-hunt sensation that sold 15 million copies in under 30 days, ran into a double-barreled security crisis: user-created Workshop maps found carrying malware, and the game's official Discord server getting hijacked at almost exactly the same time.
How the malware maps were discovered
The situation came to light on Thursday when an independent security researcher going by Feint published a breakdown after a friend noticed something odd: a command prompt window briefly flashing on screen while a Workshop map was downloading. That's not normal behavior, and Feint dug in.
What they found inside the map files was what they described as a malware dropper, code designed to silently install something nasty on your machine without any obvious sign it's happening. The map in question, Laser Tag Neon, was pulled from the Workshop once the discovery went public.
Here's the thing: it didn't stop there. A second infected map, Chroma Grid Arena, appeared to take its place shortly after, though that one was also removed once flagged.
One engineer's PC, two crises at once
Developer Lemorion_1224 moved quickly, posting a series of updates to the game's Steam page. The first priority was squashing a false claim spreading through the community that the game itself contained a RAT (Remote Access Trojan) and that players needed to follow specific steps to "fix" it. That claim came directly from the hacker who had compromised the Discord, not from any legitimate source.
The Discord breach turned out to be a direct consequence of the malware investigation. While a system engineer was actively looking into the infected Workshop maps, their PC got infected in the process. The attacker used that foothold to bypass the engineer's Discord two-factor authentication, seized server permissions, and banned every official staff member from the server.
One admin account compromised. That was all it took to lock the entire team out of their own community hub.
Patch 3.1.0 closes the door
On Saturday, Lemorion_1224 shipped version 3.1.0, a patch specifically targeting the vulnerability that allowed Workshop maps to execute malicious code in the first place. The update also bundled several bug fixes. Feint confirmed that the originally identified infected maps had been removed from the Workshop by the time the patch landed.
The key here is that the game's core files were never the problem. The malware existed entirely within user-uploaded Workshop content, and the patch closes the execution pathway those maps were exploiting.
Lemorion_1224 followed up earlier today confirming the official Discord server has been fully restored and access returned to the team. For a game that's been on an almost absurdly positive trajectory since launch, this weekend was a sharp reminder that high-profile success brings high-profile attention from bad actors.
What this means for players going forward
Steam Workshop is one of gaming's best features and one of its most persistent security blind spots. User-uploaded content gets minimal vetting before it's available to download, and most players have no reason to suspect a map file could be anything other than a map file. The Meccha Chameleon situation is a textbook example of how that trust gets exploited.
For now, the immediate threat appears contained. The patch is live, the Discord is back, and the infected maps are gone. Players who haven't updated yet should do so before touching any Workshop content.
If you're new to the game and want to get up to speed on the legitimate side of things, the MECCHA CHAMELEON beginner's guide covers everything from the paint system to Seeker strategies. For those already comfortable with the basics, the full MECCHA CHAMELEON guide collection has map-specific tips and hiding strategies to keep your sessions competitive while the Workshop situation settles.
