Major Game of the Year Hit by Malware Attack Allowing Hackers to Seize User PCs
Meccha Chameleon has unexpectedly emerged as one of the year’s most explosive gaming sensations, shattering milestones by surpassing 15 million sales in under a month. However, a troubling security crisis threatens to overshadow the indie hit’s monumental success.
<p>Last week, independent security researcher Feint uncovered that <a href="https://medium.com/@FeintBE/workshop-map-for-meccha-chameleon-is-a-malware-dropper-full-breakdown-d1ac29565265" rel="noopener noreferrer nofollow" target="_blank">malicious actors had injected viruses</a> into specific user-generated Steam Workshop maps. Upon execution, custom stages like Laser Tag Neon covertly spawned an invisible command prompt to download malicious payloads—a textbook malware-dropper attack. Specifically, the exploit deployed a Remote Access Trojan (RAT), granting perpetrators unauthorized remote control over infected machines. Security experts strongly advised anyone who engaged with the compromised maps to execute a thorough system scan immediately and inspect their Documents and temporary directories for rogue .bat files.</p>
<p>Although the initial vector, Laser Tag Neon, was purged shortly after Feint’s public disclosure, threat actors brazenly replaced it with alternative malicious maps, such as Chroma Grid Arena. In an effort to mitigate the threat, <em>Meccha Chameleon</em> co-developers lemorion_1224 and Haganeiro rushed out patch version 3.1.0 to eradicate the vulnerability. Tragically, during the debugging and remediation process, the developers' primary workstation was compromised by the very same malware, giving hackers the leverage needed to hijack the game’s official 100,000-member Discord community.</p>
<p>“While resolving the mod-map malware vulnerability, a systems engineer’s workstation was infected,” <a href="https://x.com/lemorion1224/status/2081087686010671451" target="_blank">lemorion_1224 explained via X</a>. “The attacker subsequently bypassed the engineer's two-factor authentication on Discord, reconfigured server privileges, and banned all administrative staff.” The compromised machine has since been entirely wiped to prevent further tampering with source files or the introduction of secondary exploits. “The perpetrator who commandeered the Discord server may issue fraudulent statements moving forward, so please exercise extreme caution and refrain from clicking unfamiliar links or following unverified instructions.”</p>
<p>Fortunately, developers successfully <a href="https://x.com/lemorion1224/status/2081508583573987830?s=20" target="_blank">reclaimed control of the communication channel</a> following direct intervention from Discord support. “All unauthorized administrator accounts have been permanently banned. The server's highest-tier ownership has been successfully transitioned to a secure, unaffected account.” Building on these swift recovery efforts, the team deployed update 3.3.1 this morning, introducing significantly fortified virus defenses.</p>
<div class="display-card video large no-badge">
<div class="w-adsninja-video-player">
<div class="an-ignore">
<div class="adsninja-video-player emaki-video-player emaki-video-player-cb66bf5ffdebfc6b" id="emaki-video-player-cb66bf5ffdebfc6b">
<script>
window.valstream = window.valstream || {};
window.valstream.queue = window.valstream.queue || [];
window.valstream.queue.push(function(){
const fallbackContent = `<button class="prem-player-close">x</button>`;
const fallbackToNativePlayer = function(){
console.warn('Failed to load AdsNinja video player.');
const container = document.getElementById('emaki-video-player-cb66bf5ffdebfc6b');
if(!container){
return;
}
container.innerHTML = fallbackContent;
const videoPlayerContainer = document.getElementById('emaki-video-player-cb66bf5ffdebfc6b');
if(videoPlayerContainer){
const videoPlayer = videoPlayerContainer.querySelector('video');
if(typeof Waypoint !== 'undefined' && videoPlayer){
const videoPlayerWaypoint = new Waypoint.Inview({
element: videoPlayerContainer,
enter: function(direction){
if(direction == 'up'){
this.element.classList.remove('video-player-floating');
}
},
entered: function(direction){
if(direction == 'up'){
this.element.classList.remove('video-player-floating');
}
},
exit: function(direction){
if(direction == 'down' && !videoPlayer.paused){
this.element.classList.add('video-player-floating');
}
},
exited: function(direction){
if(direction == 'down' && !videoPlayer.paused){
this.element.classList.add('video-player-floating');
}
},
offset: -50
});
}
const closeButton = videoPlayerContainer.querySelector('button.prem-player-close');
if(closeButton){
closeButton.addEventListener('click', function(){
videoPlayerContainer.classList.remove('video-player-floating');
if(videoPlayer){
videoPlayer.pause();
}
});
}
if(videoPlayer && typeof Waypoint !== 'undefined'){
videoPlayer.addEventListener('fullscreenchange', function(){
Waypoint.refreshAll();
});
}
}
};
if(!window.an || typeof window.an.monetizeVideo !== 'function'){
fallbackToNativePlayer();
}
else{
window.an.monetizeVideo(
'.emaki-video-player-cb66bf5ffdebfc6b',
JSON.parse(`{\"name\":\"Instream-InContent\",\"groupName\":\"content\"}`),
JSON.parse(`{\"trackingId\":\"in-content\",\"playlist\":[{\"title\":\"Meccha Chameleon trailer\",\"description\":\"\",\"length\":\"0:22\",\"mimeType\":\"video\\/mp4\",\"url\":\"https:\\/\\/video.polygonimages.com\\/2026\\/06\\/meccha-chameleon-best-indie-games-trailers-1781629670.mp4\",\"thumbnailLink\":\"https:\\/\\/static0.polygonimages.com\\/wordpress\\/wordpress\\/wp-content\\/uploads\\/2026\\/06\\/vlcsnap-2026-06-16-18h09m23s340.jpg?fit=crop&w=1024&h=576\",\"textTracks\":[{\"kind\":\"subtitles\",\"label\":\"English\",\"language\":\"en\",\"url\":\"https:\\/\\/video.polygonimages.com\\/2026\\/06\\/meccha-chameleon-best-indie-games-trailers-1781629670-1781629881.vtt\",\"default\":false}]}]}`)
).catch(fallbackToNativePlayer);
}
});
</script>
</div>
</div>
</div>
</div>
<p>While the exact number of impacted players remains undetermined, evidence suggests the exploit may have lurked within the game ecosystem for quite some time. A troubling Steam user review from July 8 warned: “This game poses an exceptionally severe security risk. While playing in a session hosted by a friend, their computer was compromised, and an unauthorized entity actively attempted to hijack their hardware.” Though unverified independently, the precise symptoms detailed in the review align seamlessly with the discovered malware signatures.</p>
<p>Although the threat was strictly contained to users engaging with custom environments and appears to be neutralized, this incident highlights a troubling pattern of malicious software infiltrating Steam titles. Just two months prior, <a href="https://www.pcguide.com/news/valve-removes-free-horror-game-from-steam-after-players-discover-it-contains-malware-that-steals-your-data/" target="_blank">Valve pulled the free-to-play horror title</a> <em>Beyond The Dark</em> from the storefront after discovering it covertly harvested user data and cryptocurrency credentials. A series of comparable security breaches ultimately prompted the <a href="https://www.fbi.gov/how-we-can-help-you/victim-services/seeking-victim-information/seeking-victim-information-in-steam-malware-investigation" rel="noopener noreferrer nofollow" target="_blank">Federal Bureau of Investigation to launch an official inquiry</a>, establishing a dedicated portal to gather intelligence from affected users.</p>
<aside class="display-card article article-card small no-badge active-content" data-include-community-rating="false" id="meccha-chameleon-steam-game-price-where-to-play" data-nosnippet>
<img width="440" height="248" loading="lazy" decoding="async" alt="A chameleon hiding above a door camouflaged in blue while a hunter is about to walk through the door in Meccha Chameleon." src="https://static0.polygonimages.com/wordpress/wp-content/uploads/2026/06/meccha-chameleon-explained-header.jpg?q=49&fit=crop&w=220&h=124&dpr=2" bad-src="https://static0.polygonimages.com/wordpress/wp-content/uploads/2026/06/meccha-chameleon-explained-header.jpg?q=49&fit=crop&w=220&h=124&dpr=2">
<span data-field="label" class="article-card-label"><label>Related</label></span>
<div class="w-display-card-content regular article-block">
<h5 class="display-card-title">
What the heck is Meccha Chameleon and why did it sell millions of copies in days?
</h5>
<p class="display-card-excerpt">Like Prop Hunt with more artistic talent</p>
<div class="w-display-card-extra">
<div class="total-info extra-comments">
<label class="total-info-label">Posts</label>
<span class="num">6</span>
</div>
</div>
<div class="w-display-card-details">
<div class="w-display-card-meta"></div>
</div>
</div>
</aside>Source: Polygon
Related articles
Nidhogg Developer’s Bullet Heaven Platformer Blood Dungeon Launches Next Month
New Trailer For S.T.A.L.K.E.R. 2’s Cost Of Hope Expansion Reveals August Release Date
God of War: Laufey Releases in February
Did Final Fantasy Just Tease the Director of the Next Mainline Game?
DYSTOPICON launches on Steam with six scenarios and 14 endings
Popular Isekai Anime Confirms Season 4 Release Window and Another Studio Change
Death Saves: The New Official D&D Dark Fantasy Setting We Desperately Needed
Rick and Morty Showrunners Explain the Reason for Season 9’s Brutal Finale