User-made maps from Steam top-seller Meccha Chameleon have been found to contain malware, just as the game's official Discord server got hacked

The indie viral mega-hit prop hunt game Meccha Chameleon has had quite the unfortunate weekend. The game's developer has responded to a report claiming some of the game's Steam Workshop maps included malware. Those maps are user-created, and - like all Workshop maps - were available to download by anyone who owns the game.

The initial report was published on Thursday by an independent researcher going by Feint. In their rundown on Medium, they looked into one particular Steam Workshop map after a friend reported "seeing a command prompt window briefly appear" while the map was being downloaded. Upon analysing the files, they found "what appears to be a malware dropper" embedded in the map.

Laser Tag Neon was the map in question, which was quickly removed from Meccha Chameleon's Steam Workshop page after the discovery was made public. Unfortunately, as they later revealed to International Cyber Digest, a different malware-infected map quickly took its place (Chroma Grid Arena) - though that too appears to be gone.

Meccha Chameleon developer Lemorion_1224 swiftly responded, posting multiple updates on the game's Steam page. The developer initially addressed the situation by clarifying the game itself is safe, and does not contain malware. That claim had apparently originated from a hacker responsible for a different crisis the developer was also dealing with on the same day: the game's official Discord account getting hacked.

"Claims made by the hacker who compromised our Discord - stating that 'the latest update contains a RAT (Remote Access Trojan) and you must follow specific steps to fix it' are 100 percent false," the developer said.

Lemorion_1224 later clarified that the account of "a single admin" is what's been compromised, leading to the hack and causing the unfortunate cascade of events to occur.

"While investigating and patching a malicious mod map issue, a system engineer's PC was infected with malware," the developer explained in a follow-up post. "The hacker bypassed the engineer's Discord Two-Factor Authentication (2FA), took over server permissions, and banned all official staff members from the server."

On Saturday, Lemorion_1224 released a new Meccha Chameleon patch (version 3.1.0) to address the vulnerability that allowed maps to execute malware, and fixed some bugs. According to the researcher who originally brought the issue to light, those originally identified malware-containing maps have been removed.

The top of Feint's original Medium post includes some useful tips to check whether or not your PC has been infected, as well as some best practices everyone should follow before downloading Steam Workshop content.

"If you launched one of the affected Workshop maps before updating to version 3.1.0, it is strongly recommended that you perform a full malware scan and investigate your system for signs of compromise," the post advised.

Seemingly to tie it all in a neat little bow, Lemorion_1224 announced earlier today the official Mecca Chameleon Discord has been restored, and everything is seemingly back to normal.

Mecca Chameleon is one of Steam's biggest hits in 2026 so far, having sold a staggering 15m copies in one month.