Malware Found in Meccha Chameleon Steam Workshop Map

Players of the hit indie multiplayer hide-and-seek game, Meccha Chameleon, are being warned to exercise caution when downloading Steam Workshop maps, as one map has been found to have been infected with malware and spreads it to a player’s device.

This discovery quickly gained attention across social media and the PC gaming community, urging players to avoid downloading unfamiliar Workshop content until more information on the malware becomes available.

The issue of the malware-infested map was discovered by a security researcher named Feint on the online publishing and blogging platform, Medium.com . He investigated a few reports from players who noticed a Command Prompt window briefly appearing while Steam automatically downloaded a custom Steam Workshop map by the name of “Laser Tag Neon.”

According to Feint’s investigation, the suspicious map appeared harmless at first glance, only containing assets of the laser-tag-themed game level. However, a closer examination revealed a hidden Blueprint actor disguised as a normal environmental controller, which, in simpler terms, can seem like a lighting asset for a game. But it’s actually a line of bytecode that writes data onto a device’s disk.

When this map loads, the Blueprint reportedly writes this batch file of code into the player’s device before launching a hidden PowerShell process with restrictions being bypassed. As Feint attempted to test the Blueprint file himself, he did notice that the file was supposed to retrieve some additional code through an external server, but this download from the executed malware file failed.

Despite this failure, writing executable files into a player’s Documents folder and launching hidden PowerShell commands falls out of bounds of typical modding behavior in games. It pretty much makes the Blueprint file itself highly suspicious, unnatural, and potentially dangerous.

Other warning signs were also found on Steam regarding the map. The account that has uploaded the map is said to have only been around a week old, had and ratings disabled, preventing Meccha Chameleon players from warning others the malware-infested map.

Within hours of the news of the malware-infested map on Meccha Chameleon, one of the developers @haganeiro_fn on X (formerly Twitter) had announced that the vulnerability in the custom maps described in the recent update of the game has been patched up and fixed.

Additionally, they confirm that the malware has been disabled for the affected maps before and after the update. With that, it’s great that the developers immediately addressed the issue before more players became victimized by the map.

Now, if you’re a Meccha Chameleon player who has recently downloaded the “Laser Tag Neon” Workshop map, it’s recommended to take a few precautionary steps:

Taking these steps will make it easier for you to deal with the malware-infested map on Meccha Chameleon. Keep calm and don’t do anything rash yet.

If you want to know more Meccha Chameleon and why it’s become such a hit game, check out our feature piece on how Meccha Chameleon reached popularity below: