Image via: lemorion_1224
Image via: lemorion_1224
Over 15 million fans enjoy playing Meccha Chameleon unaware of a threat lurking in one of its user-generated maps. A researcher uncovered the malware after discovering it via friends.
A researcher named Feint on Medium found a malicious script hiding as a Meccha Chameleon map on Steam Workshop. In a lengthy post, Feint noted that a command prompt window would quickly open and close for their friends.
The malware auto-executes when players enter the game or join specific lobbies. On the surface, the map's files appear totally harmless.
However, Feint dug deeper due to their suspicion to discover a deeper problem: a Blueprint actor. Once it gets into your system, it downloads a batch file that eventually triggers a PowerShell process.
a monitor shows the logo of Steam which is a videogame store developed by Valve software house producer of games as Half-Life and Counter Strike in Bologna, Italy, 10 March 2021 xkwx steam, store, valve, videogames, software house, background, producer, half-life, counter strike, shooter, Illustrative Editorial, american, dashboard, brand, company, developers, devs, entertainment, famous, games, gaming, dark, genre, haze, horizontal, house, icon, logo, market, monitor, black, pc, screen, show, software, gabe newell, ultrawide, video, video game, video games, canadian, blue, discounts, community, pc gaming, pc gamers, platform
a monitor shows the logo of Steam which is a videogame store developed by Valve software house producer of games as Half-Life and Counter Strike in Bologna, Italy, 10 March 2021 xkwx steam, store, valve, videogames, software house, background, producer, half-life, counter strike, shooter, Illustrative Editorial, american, dashboard, brand, company, developers, devs, entertainment, famous, games, gaming, dark, genre, haze, horizontal, house, icon, logo, market, monitor, black, pc, screen, show, software, gabe newell, ultrawide, video, video game, video games, canadian, blue, discounts, community, pc gaming, pc gamers, platform
The PowerShell can call for other files onto an infected PC. Feint could not determine the purpose of the malware's final payload.
The researcher also highlighted suspicious facts about the account that put the map on the community page. According to Feint, the account was only about a week old and had comments/ratings disabled.
After its discovery, the map was reported to Steam. However, it's difficult to tell whether or not this will make enough of a difference.
That being said, until Valve deals with this problem, it's best to avoid purchasing or downloading any of these games from the Workshop.
A malware like this can slip through the cracks, so if you have played a custom user-created map before, it's best to run it through your antivirus.
Given Meccha Chameleon's popularity, many of players could potentially have interacted with the map.
Meccha Chameleon: The numbers speak for themselves
Meccha Chameleon may end up being the most successful indie game of the year. In it, players are basically tasked with hiding themselves using various objects and the environment available. Meanwhile, someone will try to find them while they hide.
This simple yet fun format has attracted the attention of over 15 million fans. The game only exists on Steam and hasn't seen a release anywhere else.
This formula has outdone familiar franchises in terms of sales. According to Alinea Analytics' Head of Market Analysis, Rhyss Elliot, the game has outsold giants like EA FC 26 (9.1 million), Resident Evil Requiem (7.5 million), and Forza Horizon 6 (7.4 million) in terms of unit sales in H1 2026.
The question is, will players stop playing because of the malware-infected map? Let us know in the comments.
Read more at Gaming Community by Max Level!
Written by
Prit Chauhan