Meccha Chameleon Steam Workshop Malware and Discord Hijack: What Happened and How to Stay Safe

How Custom Steam Workshop Maps Spread a Remote Access Trojan

The attack chain began on July 24, 2026, when independent security researcher Feint (FeintBe) discovered that several user-created maps on the Steam Workshop were hiding malware . The known infected maps were "Laser Tag Neon" and "Chroma Grid Arena" .

When a player loaded one of these infected maps, a hidden script wrote a .bat file to the user's Documents folder and used PowerShell to fetch additional malicious payloads from a remote server . That payload was a Remote Access Trojan (RAT) — malware that gave attackers full remote control over the victim's PC .

Crucially, the malware executed only when a player launched the map in-game. Simply subscribing to the map on Steam Workshop without loading it did not trigger the infection . The maps exploited a vulnerability in how the game processed user-generated content, allowing arbitrary code execution on the player's machine .

How the Discord Server Was Breached

The 100,000-member Discord server hijacking was a direct consequence of the malware infection, not a separate attack.

While investigating the malicious maps, the developers — Lemorion_1224 and Haganeiro — downloaded the infected content onto a systems engineer's testing PC to analyze the threat. That machine became compromised . The attacker used this foothold to steal an administrator account's credentials and bypassed two-factor authentication (2FA) by hijacking an active Discord session . Once inside, the attacker banned all existing admins, locked out the development team, and seized full control of the server . The hackers then posted fake messages urging players to "delete the game immediately" and spread more malware links from the compromised server . Developer Lemorion_1224 stated publicly: "Security was completely breached, the server creator's account was hijacked, and all admins were banned, so we can't take action from our side" .

Steps Developers Took to Patch and Recover

The development team moved quickly on several fronts:

• Game patch (v3.1.0): Released on July 25, 2026, this update patched the vulnerability that allowed malicious maps to execute code on players' machines .
• Infected map removal: The "Laser Tag Neon" and "Chroma Grid Arena" maps were removed from the Steam Workshop .
• Discord recovery: The developers worked with Discord's trust and safety team to regain control of the server. All hacker accounts were banned .
• New community server: A temporary backup Discord server was created while the original was being reclaimed .
• Confirmation of safety: By July 26–27, the developers confirmed the game was "safe to play" again, the vulnerability was fixed, and the Discord server was under legitimate control .

Developer Haganeiro confirmed that the vulnerability was fully fixed in update 3.1.0 and that the malware in the affected maps had been disabled .

Advice Given to Players About Staying Safe

1. Update the game immediately

Version 3.1.0 contains the fix. Players still on older versions remain vulnerable .

2. Do not trust messages from the compromised server

During the hijack, hackers posted fake "delete the game" warnings and malicious links. After the server was reclaimed, all such posts were removed, but any player who interacted with them should be cautious .

3. Run a full antivirus scan if you played custom Workshop maps

Any player who downloaded and launched "Laser Tag Neon" or "Chroma Grid Arena" after mid-July 2026 should run a full antivirus or anti-malware scan immediately. Security researcher Feint warned that the malware could give attackers full remote access to the victim's PC .

4. Only download maps from established creators

Feint specifically warned: "If the uploader is a brand-new Steam account or has disabled comments on their Workshop item, consider that a major red flag" .

5. The game itself is clean

The exploit was in the custom content pipeline, not in the base game files. The developers confirmed that even if a hacker compromised a developer PC, Steam's infrastructure prevents unauthorized game updates from being published .

6. For players who may have been infected

If you suspect your PC was compromised, run a full malware scan with a trusted anti-malware tool such as MalwareBytes. In severe cases, a full Windows reinstallation may be the safest option .

Key Takeaway for Players

The Meccha Chameleon Steam Workshop malware and Discord hijack serves as a reminder that user-generated content can be a vector for serious security threats, even on platforms with review processes. The developers have patched the exploit, removed the known malicious maps, and reclaimed their community server. Players should update to version 3.1.0, run a malware scan if they played custom maps, and exercise caution when downloading user-generated content from unknown creators in the future .