Meccha Chameleon, the indie title that has seen significant success with over 15 million copies sold, is currently dealing with security issues affecting its player base and community channels. Reports indicate that malware was distributed through several of the game's Steam Workshop maps, and its official Discord server has been compromised.
An independent researcher, Feint, published a report detailing how a community-created map named "Laser Tag Neon" on Meccha Chameleon's Steam Workshop, despite passing Steam's review process, would briefly open a command prompt window. This action initiated the download of a script designed to install malware on users' PCs.
While the "Laser Tag Neon" map was quickly removed, further malicious maps were reportedly uploaded in its place. The developers behind Meccha Chameleon, lemorion_1224, have since released version 3.1.0 of the game, which they state patches the vulnerability. However, this fix was implemented following a separate security incident concerning the game's official Discord server.
The development team announced that their official Discord server had been hacked and they were unable to regain control. They have contacted Discord Support for assistance, and are preparing to establish a new server if the original cannot be recovered. In a separate statement, lemorion_1224 explained that during the process of fixing the malware issue in the mod map, a system engineer's PC became infected. The hacker reportedly bypassed the engineer's two-factor authentication on Discord, altered server permissions, and removed staff members from the server, making recovery of the original Discord server unlikely.