Meccha Chameleon malware traced to infected Steam Workshop maps

Developers of the Steam hit Meccha Chameleon say recent malware affecting some players originated in infected Steam Workshop maps, not the game’s distributed files. A compromised engineer PC allowed an attacker to access the project’s Discord server.

The team reported the engineer’s computer was infected while it was being repaired. The attacker used that access to take control of the official Discord channel and to ban staff members. The studio said it has contacted Discord support to regain control and that the compromised machine has been wiped.

Investigators found the malicious files bundled with community-created Workshop maps. Two user-made maps, Laser Tag Neon and Chroma Grid Arena, were flagged as carriers. Players who downloaded those maps or clicked links shared on the compromised Discord server may have been exposed. One Discord moderator was infected before the server was secured.

The developer wrote that “there is absolutely no virus in the game files themselves.” The team urged players to keep antivirus software active, avoid following suspicious links, and rely on verified Workshop content. They advised waiting for reviews before downloading unvetted maps or mods.

The studio reported no confirmed cases of widespread damage tied to the incident and said remediation is underway. The posted list of flagged Workshop items aims to limit further spread while Discord support works to restore full control of the community channels.

Meccha Chameleon launched last month and sold more than one million copies in its first week on Steam. The incident is limited to third-party Workshop content and the compromised Discord access, according to the developer.