Malware Exploit Discovered in Popular Indie Game Meccha Chameleon

A recent security breach in the indie game Meccha Chameleon has raised alarms after malware was found embedded in custom maps distributed via the Steam Workshop. This vulnerability was uncovered during an independent investigation that detected suspicious command-line instructions hidden within community-created scenarios. The developers confirmed the issue and promptly released patch 3.1.0 to prevent further exploitation. The core flaw originated not from the official game files but from the system that loads modified maps downloaded through Valve's platform.

Cybersecurity researcher Feint discovered the exploit while analyzing a workshop map named Laser Tag Neon. When this custom scenario was loaded on Windows, it triggered a brief Command Prompt window, indicating suspicious activity. Further investigation revealed that the embedded code utilized Unreal Engine Blueprints to create an s.bat file in the player's Documents folder, which then initiated a hidden PowerShell process to download additional scripts from a remote server.

During the investigation, it was noted that the attacker's server returned a 404 error, preventing analysts from determining the final payload of the malware. However, the malicious code served no legitimate purpose within the game maps. Following the discovery, the Laser Tag Neon map was removed from the Steam Workshop, but reports indicated that other malicious scenarios were uploaded shortly thereafter. The exploit was activated when players executed the infected map or joined a lobby running it.

In a concerning turn of events, a developer executed the infected map on a secondary computer, leading to compromised credentials and an unauthorized takeover of the official Discord server. The attacker banned team members and falsely claimed that the update 3.1.0 contained a trojan, a claim that developers have firmly denied. After the incident, the affected machine was formatted, and developers confirmed that it had no access to official build distribution files.

Meccha Chameleon, launched in June 2026, has quickly become one of the year's biggest indie successes, selling over 15 million copies within its first month. The incident highlights the ongoing security challenges faced by games that allow user-generated content and the importance of vigilance in monitoring community contributions.