Meccha Chameleon Malware Warning: Update Now and Avoid the Old Discord

Meccha Chameleon players are being told to update the game right away and stay off its original Discord server.

Harmful custom maps on the Steam Workshop were infecting computers, and one of those infections eventually let attackers take over a developer account.

How the problem was found

The issue was first laid out by independent researcher Feint, who looked into complaints that command prompt windows kept popping up when players loaded certain custom maps.

Feint traced it to a Workshop map called Laser Tag Neon. The map could drop a batch file into a player's Documents folder, which then tried to pull down and run a second harmful file from an outside server.

That map was taken down, but Feint soon spotted a replacement upload named Chroma Grid Arena doing the same thing.

One important detail: just subscribing to a bad map did not set anything off. The map had to actually be loaded into a match for the trouble to start.

The fix and what players should do

Developer Haganeiro confirmed the hole was closed in update 3.1.0 and said there are no issues once the patch is applied. The team also disabled the malware on the flagged maps, even for people who had not updated yet.

Feint later dug into that second file and found it installed a tool that could give an attacker ongoing remote control of an infected machine.

If you loaded any suspicious maps before updating, the advice is to run a full malware scan. Feint also suggested checking your Documents and temporary folders for recently made .bat files.

The Discord takeover

Things then spilled over to the game's official Discord, which had close to 100,000 members.

Developer LEMORION explained that a system engineer used a backup computer while investigating the bad maps and infected it in the process.

The attacker reportedly used that machine to get into the engineer's Discord account, slip past two-factor authentication, rewrite the server's permissions, and ban the game's staff.

The developer stressed that the affected computer had no access to the source code, game files, or Steam developer accounts. It also shot down messages posted through the hijacked server that claimed the official game build contained malware.

Where things stand now

Players are being warned not to trust any announcements or links posted in the original Discord while the team waits to hear back from Discord Support. A new community server has been set up as a replacement in the meantime.