Meccha Chameleon Malware Crisis: How Steam Workshop Maps Infected Players and Led to a Discord Server Hack

How the Malware Spread Through Custom Maps

The crisis began on July 24, 2026, when security researcher Feint (FeintBE) published a detailed analysis on Reddit . He had discovered that two custom maps on the Steam Workshop — "Laser Tag Neon" (Workshop ID 3765145606) and "Chroma Grid Arena" — contained hidden malicious scripts embedded within the game's Blueprint scripting system .

When a player loaded one of these maps, the Blueprint activated automatically and briefly flashed a command prompt. What happened next was a full malware delivery chain :

• The Blueprint wrote a batch file (s.bat) into the user's Documents folder .
• That batch file launched a hidden PowerShell process with bypassed execution policy .
• PowerShell contacted an external server (hosted in the Netherlands) to download a second-stage payload, though the server returned a 404 error, meaning the payload was not ultimately delivered .
• The malware had the capability to read private files, upload them to a remote server, and potentially execute ransomware or delete data .

The compromised maps were later re-uploaded under alternate names such as "Neon Void Arena" . According to Feint's analysis, the malicious map had passed Steam's Workshop review process undetected .

Important: The game's own executable files were never infected. The exploit was isolated to Workshop custom content .

The Discord Server Hack: A Chain Reaction

On July 25, the same day LEMORION pushed Patch 3.2.0 to fix the Workshop exploit, the game's official Discord server was hacked .

The attacker gained access through an admin's backup PC, bypassing 2FA security . According to Steam community reports, the breach may have been caused by a developer or server owner downloading the infected Workshop map, inadvertently exposing admin credentials .

Once inside, the hacker :

• Deleted the server's channel structure
• Banned legitimate staff members
• Posted bizarre, threatening messages and fake virus warnings — including false claims that the game update contained a Remote Access Trojan (RAT)
• Spammed malicious links targeting the community

Developer LEMORION's Response

Developer LEMORION moved quickly to contain the damage across three fronts:

1. Patch 3.2.0 (July 25): Closed the Blueprint-based exploit that allowed custom maps to execute arbitrary system commands .
2. Content removal: The two known malicious maps were flagged and removed from Steam Workshop .
3. Public communication: LEMORION confirmed the game files were never compromised, labeled the RAT claims as "100% false," and urged players not to click any links in the compromised Discord . The developer also wiped the infected admin PC and reached out to Discord support to regain control of the server .

Steam Community Reactions

The Meccha Chameleon community responded with alarm and frustration. On Steam forums and Reddit, players expressed shock that custom maps — not executables — could deliver malware, challenging the long-held assumption that Workshop content is safe .

Key community responses included :

• Players reporting infections after playing the suspicious maps and running virus scans for confirmation
• Warnings not to download any Meccha Chameleon Workshop maps until the situation was resolved
• Criticism of Valve for not having stronger content-scanning safeguards on the Workshop

Broader Security Implications for the Steam Workshop Ecosystem

The Meccha Chameleon incident highlighted a fundamental security gap that extends far beyond a single game:

• Blueprint-level code execution: The fact that a game's own scripting system could be weaponized to run arbitrary system commands means the risk applies to any Steam game that allows user-generated scripts without sandboxing .
• Trust undermined: The Steam Workshop has long been viewed as a semi-official, curated space. This attack showed that malicious actors can publish seemingly legitimate content that bypasses Valve's moderation .
• A formal cybersecurity alert was issued via Govly, noting that Valve Corporation now faces a credible Workshop malware risk that had received little public attention .
• Recommended mitigations include scanning Workshop uploads for embedded system command execution, sandboxing Blueprint/VScript environments, and educating players to treat Workshop content with the same caution as third-party downloads .

Bottom Line

The Meccha Chameleon incidents of July 2026 demonstrate that Steam Workshop content can serve as a viable malware delivery vector, even when the game itself is secure. While the developer acted swiftly to patch the exploit, the Discord hack exposed the cascading consequences of a single infected system.

Players who played "Laser Tag Neon" or "Chroma Grid Arena" after July 15 are advised to check their Documents folder for a file named s.bat and run a full antivirus scan . Until the official Discord server is fully restored, avoid clicking any links posted there.