The developers of the popular indie title Meccha Chameleon have released an urgent update 3.1.0 to close a critical vulnerability that allowed users to download malware disguised as maps on Steam Workshop. During the investigation of the incident, it was discovered that hackers infected the PC of a system engineer and took over the project’s official Discord server.
The developers of the popular indie title Meccha Chameleon have released an urgent update 3.1.0 to close a critical vulnerability that allowed users to download malware disguised as maps on Steam Workshop. During the investigation of the incident, it was discovered that hackers infected the PC of a system engineer and took over the project’s official Discord server.
The issue was first reported by an independent cybersecurity researcher under the pseudonym Feint, according to Kotaku. Information about the emergence of new malicious maps after the removal of the original source of the threat was also confirmed by the International Cyber Digest, and details of the hack of the Discord server were revealed directly by the game developer under the nickname lemorion_1224.
According to Feint, a custom community map called Laser Tag Neon successfully passed Steam Workshop’s automated scan, but when launched, it briefly opened a command prompt and downloaded a script to install the virus. After the map was removed, the attackers uploaded new modifications with similar malicious code.
The vulnerability was only fixed in version 3.1.0, but the process of eliminating the threat led to the compromise of the developers' internal systems.
«While troubleshooting a malware issue embedded in a MOD card, a system engineer’s computer was infected,» lemorion_1224 reported on X. The attacker bypassed the employee’s two-factor authentication in Discord, changed access rights, and locked out all project management.
The team is currently trying to restore access through the platform’s support service, although the chances of regaining control are assessed as minimal.
«The game itself is not affected. Currently, the official MECCHA CHAMELEON Discord server has been hacked, and we are absolutely unable to take any action on our part. If the server cannot be restored, we will create a new one,» the team said in an official statement on the game’s Steam page.
Meccha Chameleon became the most successful indie release on Steam in 2026, selling over 15 million copies. The project gained popularity thanks to its active support for user-generated content, but it was the openness of the Steam Workshop to custom modifications that became the main vulnerability for the game’s million-strong audience.
