UPDATE (July 25, 2026): Meccha Chameleon devs have responded to the issue, explaining what went wrong, and what players should do next, especially if they're in the game's Discord server. The full statement is below.
We now have a full picture of the situation and would like to share the verified details with you.To get straight to the point: The game itself is 100% SAFE and virus-free. This incident was strictly limited to a single admin account's Discord being compromised.What Happened:…July 25, 2026
"To get straight to the point: The game itself is 100% SAFE and virus-free. This incident was strictly limited to a single admin account's Discord being compromised.
What Happened: While investigating and patching a malicious MOD map issue, a system engineer's PC was infected with malware. The hacker bypassed the engineer's Discord 2-Factor Authentication (2FA), took over server permissions, and banned all official staff members from the server.
Game File Security: The infected PC was a spare testing machine, and it is physically impossible to access or edit game source files from it (which we have re-confirmed via logs). The affected PC has already been completely wiped and reformatted.
A Warning to Players: The perpetrator who took over the Discord server will likely continue to release fake statements and announcements. Please do NOT click any links, join fake servers, or follow any instructions posted on that Discord."
The original article continues below:
It seems like everyone these days is playing the insanely popular indie game Meccha Chameleon on PC, my friends included. If you've also played, you're going to want to double-check what custom, user-created maps you've downloaded from the Steam Workshop.
Worse, if you've already downloaded some custom maps for the game, I strongly suggest you A) finish reading about the issue, and B) check your Steam library.
A security researcher who goes by Feint on Medium.com recently posted a lengthy analysis breaking down their findings. They posit that some workshop maps associated with Meccha Chameleon are quietly being rigged to drop malicious scripts (aka malware) onto players' PCs.
Feint began the investigation after friends noticed a command prompt window flashing briefly as Steam downloaded a custom workshop map for the game. These downloads are handled automatically as you load into certain game lobbies.
On the surface, the custom map's files looked totally normal, with standard Unreal Engine 5 asset containers and a lack of evident executables or scripts.
Digging deeper, however, Feint discovered the real problem: a Blueprint actor with a naming mismatch buried inside the map's metadata. It was built to look like an ambient controller, but an outdated internal name tipped off the researcher.
According to Feint, the Blueprint is built to run automatically the moment the map loads. When it does, it injects a batch file into the gamer's Documents folder on their Windows PC. Not good.
Once triggered, the batch file sneakily launches a hidden PowerShell process with bypassed execution policy before calling out to an outside server to download a second script.
Feint's testing resulted in that download failing, so it remains unclear what exactly was intended to be sent to infected PCs.
No name for the malware, but a map shouldn't act like this
Although the final goal of the odd script is debatable, a game's map should never involve writing and executing scripts outside of the game's folder. This is a clear sign of malware.
Feint also notes that there are some red flags surrounding the account that uploaded the map to Steam Workshop. The Steam account is only about a week old and has comments/ratings disabled on the listing, making it much harder for savvy victims to share their woes.
The malware-infused map has been reported to Steam, though it's unclear whether any actions have been taken yet.
What you should do if you've downloaded Meccha Chameleon Workshop maps
Until Valve confirms that the map is malicious and pulls it from the Workshop library, your best bet is to avoid any new Meccha Chameleon maps, especially if they lack reviews and/or have comments disabled.
If you've downloaded custom maps recently, it's probably worth running a PC scan with your favorite antivirus. You can also check your Documents folder for any strange .bat files hanging around.
To be clear, this isn't the fault of the developers. Rather, this is another bit of potential malware that slipped past Steam's Workshop screening process.
Just last month, Steam's most popular PC background app, Wallpaper Engine, was discovered to be infecting users with malware. Valve, owner of Steam, took the necessary steps to remove the infected files, but added that this sort of thing could inadvertently happen again.
Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.
