A vulnerability in Meccha Chameleon, which has already been patched, allowed multiple Steam Workshop maps to distribute malware to players.
As a post on Medium from user Feint discussed (via Kotaku), "A couple of my friends reported seeing a command prompt window briefly appear while Steam was downloading a custom workshop map … What I found was a seemingly ordinary workshop map that contained what appears to be a malware dropper, despite having passed workshop review."
