Hello there, Workshop wanderers, lobby hiders, Discord regulars, and everyone who has ever pressed Subscribe because a custom map thumbnail looked fun enough.
In June, Game Cookies covered MECCHA CHAMELEON as a three-million-sale lesson in streamer-friendly design. The game kept sprinting. Newzoo’s June analysis says its developer celebrated more than 15 million copies sold, while the title ranked second in PC revenue behind Fortnite across Newzoo’s covered markets.
Then the tiny hide-and-seek game received the least charming possible demonstration of scale. Malicious Steam Workshop maps used a game-specific vulnerability to execute files on players’ PCs. The developers patched the route, but an infected testing computer used during the response was followed by a takeover of the official Discord server.
The current version is reported safe, the known malicious maps were disabled or removed, and the Discord has been restored. Those fixes close the immediate emergency. They also expose the operational bill that arrives when a two-person project suddenly serves an audience measured in millions.
A custom map crossed the line into Windows
Security researcher Feint began investigating after players saw a command window flash while a Workshop map was loading. In the map called Laser Tag Neon, the researcher found an Unreal Engine Blueprint that wrote a batch file into the user’s Documents folder. That script launched hidden PowerShell, contacted an external server, downloaded another batch file, and attempted to execute it. The technical breakdown later reported that a recovered second-stage sample installed a remote access trojan, or RAT.
The first investigation could not retrieve that second stage because the server returned an error. Feint later updated the report after the payload was recovered and analyzed. That sequence deserves precision: the map’s malicious dropper behavior was established first; the RAT conclusion followed from later analysis of the recovered second stage.
The malicious content hid inside valid-looking Unreal Engine asset containers and used the game’s normal map-loading path. Players were not being asked to launch an obvious executable. They were doing the ordinary thing the Workshop encourages: loading user-created content inside a supported game.
🦊 Kiki: I love mods. I also love doors. I prefer both when they do not quietly write a batch file into my Documents folder. This map arrived dressed for laser tag and behaved like a plumber who asks to use the bathroom, then rewires the house.
A polished Subscribe button cannot be the entire security briefing. If the cute map thumbnail can reach PowerShell, the thumbnail needs fewer vibes and more background checks.
🍪 Chip holds the Subscribe button with barbecue tongs.
The patch worked, then the response machine became the next target
The developers shipped version 3.1.0 with a security patch for MOD maps. Their next update said the earlier fix made it impossible for custom content to execute unrelated files such as malware and added that Steam Support had confirmed the result. The researcher also reported that the known malicious maps had been removed and strongly recommended updating before using custom content again.
The response then became part of the incident. According to the developers’ official breach update, a system engineer’s spare testing PC was infected while the team investigated and patched the malicious map issue. The attacker bypassed the engineer’s Discord two-factor authentication, changed server permissions, and banned the official staff.
The team said that machine could not access or edit the game’s source files, a claim it rechecked against logs, and that the device was wiped and reformatted. On July 27, the official Steam announcement feed said the Discord server had been restored and the attackers banned.
Confusion helped the attacker. The recovered Workshop payload was reported as a RAT. The compromised Discord then circulated a separate false claim that update 3.1.0 itself contained a RAT. The first concerned malicious user-made content before the fix. The second accused the developer’s patch, and the developers rejected it while publishing the additional safety confirmation in version 3.2.
🦊 Kiki: The emergency laptop becoming the second crime scene is the cybersecurity version of calling an ambulance and watching it get carjacked at the curb. The team was trying to close one hole while the attacker climbed through the tool bag.
Nobody should gloat at a two-person studio for getting hit. The embarrassing part belongs to an ecosystem that can distribute custom content to millions, then discovers its crisis plan is a spare PC and one Discord admin account.
🍪 Chip wraps a padlock around the laptop and accidentally leaves the charging cable outside.
Fifteen million copies create a very large blast radius
MECCHA CHAMELEON launched on June 9 at $5.99 on Steam. Newzoo describes it as a two-person project built in roughly two months. Its June report placed the game sixth in PC monthly active users and second in PC revenue, behind Fortnite, while citing the developer’s 15-million-copy milestone.
Those numbers explain why a few malicious maps became an international security story almost immediately. Every additional lobby, streamer, modder, and Discord member expands the number of people who can encounter a bad asset or a fake announcement. Viral success compresses the distance between a clever prototype and publisher-scale trust operations.
⭐ Byte: Newzoo’s public ranking measures June PC revenue across France, Germany, Italy, Spain, the United Kingdom, and the United States. Its article reports the 15-million-copy milestone from the developer, but it does not publish MECCHA CHAMELEON’s dollar revenue or an infection count. The figures show scale and exposure potential. They cannot support a damage estimate.
There is still no verified public count of infected players. Reporting has identified multiple malicious maps and one compromised testing PC. Any broader number would be arithmetic wearing a lab coat.
Workshop trust is distributed across several doors
A Workshop item passes through a chain of trust. Steam hosts and presents the content. The game decides what that content is allowed to do. The developer maintains the mod tools and validates the loading path. Players interpret the platform branding, ratings, comments, uploader history, and Subscribe button as signals that ordinary use should stay inside the game.
Feint’s analysis points to a game-specific execution route inside MECCHA CHAMELEON’s custom-map pipeline. The public evidence does not describe a breach of Steam’s storefront, accounts, or update system. The developers also said the compromised testing PC could not publish a game build.
Steam’s public announcement feed carries the developer’s claim that Steam Support confirmed the fix. As of July 27, Game Cookies could not find a separate public Valve post explaining how the malicious items passed review, what automated checks were triggered, or whether broader Workshop controls changed. That gap leaves the platform-level questions open without turning this incident into a Steam-wide hack.
🦊 Kiki: The green Workshop button has the emotional design of a hotel minibar: polished, convenient, and silently charging your trust to the room. Players see Steam, the game page, a map thumbnail, and Subscribe. Somewhere in that chain, everyone assumes the next person checked under the bed.
Once a custom map can touch Windows scripting, moderation becomes airport security with anime stickers. The map does not get to wave because its thumbnail has good lighting.
🍪 Chip X-rays the custom map and finds a batch file wearing a fake moustache.
What players should do now
The immediate danger has been addressed, but anyone who used custom maps during the affected window should treat the incident seriously. The available guidance supports a short, practical checklist:
– Update MECCHA CHAMELEON to the latest available version before loading custom maps.
– If you launched Laser Tag Neon, Chroma Grid Arena, or another suspicious custom map before version 3.1.0, run a full scan with a reputable security product and investigate unexplained system behavior.
– Unsubscribe from suspicious Workshop items and report them through Steam. A new uploader account, disabled comments, or disabled ratings can be a warning sign, but none of those signals proves a map is malicious on its own.
– Use the game’s official Steam page or announcement feed to verify the restored Discord invite. Old messages and copied invitations can outlive a breach.
– Keep account recovery methods current. Two-factor authentication helps, but an infected endpoint or stolen session can still defeat the person using it.
A malware scan is a sensible response, not a magic certificate. Players who find suspicious files, persistence, or account activity should preserve the evidence and seek qualified incident-response help rather than following cleanup instructions from random Discord posts.
🦊 Kiki: Players should not need to reverse-engineer Unreal assets to decide whether laser tag is safe. Checking uploader age and comments is useful today, but it also asks customers to perform trust-and-safety work with detective tools designed for deciding whether a profile is a bot.
One-click subscribe needs one-click confidence. Anything less is a loot box where the rare drop is Windows behaving normally.
🍪 Chip asks the next map for two forms of identification and a recent utility bill.
The recovery deserves credit and a postmortem
The team patched the vulnerable path, published multiple clarifications, wiped the infected test machine, coordinated with Discord, and restored the community server within roughly two days. Current reporting says players can rejoin the official server, and the Steam feed is again under staff control.
Speed helped contain panic, especially after the attacker used the Discord takeover to impersonate the developers. A fuller postmortem would still help players and other small studios understand the exposure window, the affected mod capabilities, the detection path, the map-review failure, and the controls added beyond blocking unrelated file execution.
Valve also has a useful story to tell if it chooses to tell one. Workshop security sits at the intersection of platform review, game sandboxing, uploader reputation, reporting speed, and developer escalation. A public explanation could turn an ugly incident into reusable protection for every small team shipping user-generated content.
Our first MECCHA CHAMELEON article celebrated how two developers stripped multiplayer down to a readable, streamable idea. This incident reveals the other half of that achievement. A game can become publisher-sized in reach long before its creators have publisher-sized security, moderation, support, or communications staff.
In the end…
MECCHA CHAMELEON is playable, its vulnerable map path has been patched, and its Discord is back. The base game and official update channel were not shown to contain the attacker’s malware. The documented attack lived in malicious user-created maps, then spread into community operations through an infected response machine.
The developers moved quickly under brutal conditions. Players still deserve a durable postmortem, and platforms should help make the next emergency smaller. Virality gave a two-person team the audience of a blockbuster and the incident-response workload of one, all before the paint had dried on launch month.
⚙️ Stay skeptical of custom content that asks your PC to do more than the game.
⚙️ Keep your games updated, your security tools active, and your Workshop subscriptions deliberate.
⚙️ And remember: the funniest disguise in a hide-and-seek game should be a chair, not a batch file wearing a map thumbnail.
🦊 Kiki · 🍪 Chip · ⭐ Byte · 🦁 Leo
Found a suspicious mod, a security correction, or a chameleon hiding in your taskbar? Contact us here!
