Meccha Chameleon, this year's surprise hit with over 15 million sales in under a month, has become the target of a malware attack that leveraged its Steam Workshop community maps. An independent researcher, Feint, discovered that hackers were embedding viruses within these user-created maps, such as Laser Tag Neon. Upon launching an infected map, an invisible command prompt would download malicious software, installing a Remote Access Trojan (RAT) that allowed attackers to remotely control affected PCs.
Following Feint's findings, the Laser Tag Neon map was removed. However, additional infected maps, including Chroma Grid Arena, were subsequently uploaded. In response, Meccha Chameleon developers lemorion_1224 and Haganeiro released version 3.1.0 to patch the vulnerability. During this process, the developers' own system was infected, leading to a compromise of Meccha Chameleon's 100,000-member Discord server.
According to a post from lemorion_1224, a hacker bypassed two-factor authentication on Discord after infecting a system engineer's PC. This allowed the hacker to alter server permissions and ban staff members. The affected PC has since been wiped to prevent further exploitation. The developers cautioned users against clicking suspicious links or following any instructions from the perpetrator.
Discord support was contacted, and the developers regained control of the server. All administrators associated with the hack were banned, and the server's highest privilege account was secured. This morning, the developers released update 3.3.1, which further bolstered the game's virus protection.
The full extent of user impact remains unknown, but one Steam review from July 8 described a similar incident where a friend's computer was hacked while playing, matching the symptoms of the malware. This incident follows a pattern of security issues on Steam, including the removal of the horror game Beyond The Dark just two months prior for stealing user data and cryptocurrency. The Federal Bureau of Investigation has previously investigated similar cases and established a webpage to gather information on such threats.