'Meccha Chameleon' Face Massive Security Breach, Malware on User-Made Maps Amidst Global Trend

"Meccha Chameleon," one of Steam's biggest indie hits this year, has been hit with a wave of security problems tied to its Workshop maps, which was followed by a full takeover of its official Discord server.

The developer has since confirmed the game itself remains safe, but the incident exposed real gaps in how custom content gets reviewed before reaching players.

'Meccha Chameleon': Some User-Made Maps Contain Malware

Independent security researcher "Feint" published a detailed breakdown on Medium after friends noticed a command prompt window briefly flashing while a custom Workshop map downloaded through the game's in-game lobby.

Investigating further, Feint found that a map called "Laser Tag Neon" contained what appeared to be a malware dropper, despite having already passed Steam's Workshop review process.

According to Feint's analysis, the map quietly wrote a batch file into the player's Documents folder, then used PowerShell running in a hidden window to download and execute a second-stage malicious payload from an external server.

Laser Tag Neon was removed once the report went public, but Feint later confirmed a replacement map called Chroma Grid Arena appeared carrying the same kind of malicious code, suggesting whoever was behind the attack was actively monitoring the situation.

Players who launched suspicious Workshop maps before the game's 3.1.0 patch have been advised to run a full malware scan and check their Documents and temporary folders for recently created .bat files.

'Meccha Chameleon' Discord Faces Massive Security Breach

While the developers worked to patch the Workshop vulnerability, a separate crisis unfolded. According to the team, a system engineer's PC became infected with malware during the investigation into the malicious maps, and the attacker used that foothold to bypass the engineer's Discord two-factor authentication.

That access let the hacker take over server permissions and ban every official staff member from the game's Discord.

めっちゃカメレオンサーバーのセキュリティを突破され、サーバー製作者のアカウントが乗っ取られ、管理者が全員BANされたためこちらから手を出せません。
現在discordに問い合わせ中ですが、通報のご協力をお願いします。 https://t.co/PmT7O7c7Jz

— LEMORION🌌レモリオン (@lemorion1224) July 25, 2026

"Security was completely breached, the server creator's account was hijacked, and all admins were banned, so we can't take action from our side," Meccha Chameleon creator lemorion_1224 wrote in an auto-translated post on X over the weekend.

The hackers reportedly went as far as posting a fake listing claiming a Meta Quest-compatible version of the game existed, which it does not. An update on the game's Steam page reassured players that the game itself was not a security risk and remained safe to play as long as user-made maps were avoided.

'Meccha Chameleon' Creator Shares Update

In a more detailed follow-up shared on X, lemorion_1224 said the affected testing PC had already been fully wiped and reformatted. The creator also reiterated that the incident was strictly limited to a single admin account's Discord being compromised rather than any broader breach of the game's actual files.

The post also warned players that whoever took over the server would likely continue posting fake statements or announcements, urging the community not to click any links, join fake servers, or follow instructions posted there in the meantime.

Since then, control of the Discord has been restored to lemorion_1224 and fellow creator Haganeiro, with all the hackers banned from the server.

《めっちゃカメレオン》
ミニアップデート3.3.1が配信されました

🔧タイトル画面のディスコードURLを修正
🔧「ふくよか」の物理コリジョンを修正
🔧ウイルス対策をさらに強化

— LEMORION🌌レモリオン (@lemorion1224) July 27, 2026

A follow-up mini-update, 3.3.1, replaced the Discord link on the game's title screen with the correct server address, fixed a separate physical collision issue, and strengthened virus protection. Although it remains unclear whether the underlying issue with malicious player-made maps has been fully resolved for good.