Meccha Chameleon, a multiplayer prop-hunt game that has recently gained traction on Steam, is currently navigating a significant security challenge. Player-created maps have been identified as a vector for malware distribution, leading to player concerns and immediate action from the game's developers. The issue first came to light when a player known as Feint discovered that a map titled "Lazer Tag Zero" contained what they described as a "malware dropper." Feint's investigation revealed that a friend had experienced a brief command prompt appearance during the map's download, prompting a deeper examination of the files. Following Feint's findings, which were published in a Medium article, the "Lazer Tag Zero" map was swiftly removed from Meccha Chameleon's Steam Workshop page. However, this did not halt the spread of malicious content, as further player-made maps containing malware began to surface. The situation escalated further when the game's official Discord server was compromised. The server creator's account was reportedly hijacked, leading to the banning of all administrators and an inability for the development team to manage the situation directly. This breach was communicated by Meccha Chameleon creator Lemorion_1224 via an auto-translated post on X.
In response to the growing concerns, an update was posted on Meccha Chameleon's Steam page, assuring players that the game itself remains a safe experience, provided they avoid user-created maps. Despite these assurances, the weekend was marked by further disruption, including the appearance of a fraudulent listing for a Meta Quest-compatible version of the game, which does not exist. Lemorion_1224 addressed this issue in a separate X post, stating that no permission was granted for a product called "Meccha Chameleon VR" and that efforts are underway to have it removed from the Meta Quest store, cautioning potential buyers against any purchases.
As of early this week, the situation appears to be stabilizing. A mini-update, version 3.3.1, has been released for Meccha Chameleon. This update restores the correct Discord server link on the game's title screen, which is now back under the control of developers Lemorion_1224 and Haganiero. The update also addresses a physical collision issue and, crucially, enhances the game's virus protection. While the full resolution of the player-made map malware issue remains to be seen, developers are recommending that players stick to the game's default maps for the time being.