Malware was found embedded in the community map of the hugely popular game 'Mecha Chameleon,' resulting in users' PCs being compromised.



'

Mecha Chameleon ,' a hide-and-seek game released in June 2026 by a Japanese indie game developer, achieved cumulative sales of 15 million copies in about a month. In this game, players can add and play custom maps created by the community via the Steam Workshop. However, malware was found in one of these community maps, resulting in the official Discord server and users' PCs being compromised.

Workshop map for MECCHA CHAMELEON is a malware dropper (full breakdown)
https://medium.com/@FeintBE/workshop-map-for-meccha-chameleon-is-a-malware-dropper-full-breakdown-d1ac29565265

Hackers hit the biggest game of year with malware that let them take over users' PCs
https://www.polygon.com/mecca-chameleon-malware-attack-hackers/

On July 23, 2026, independent researcher Feint reported that the community map 'Laser Tag Neon' in the game 'Mecha Chameleon' contained a dropper that deployed and installed malware on the user's device. Feint began his investigation after receiving a report from a friend who had actually played the game, but reports of malware hacking had already appeared in Steam reviews as of July 8.



According to reports, a black command prompt window briefly appeared on the screen and then disappeared while Steam was downloading a community map. There were no crashes, error messages, or other unusual behavior, so it was possible that Steam was simply running a background process. However, since it was unusual for a console window to appear during a download from the Steam Workshop or while a match was starting, Feint decided to investigate further.

The investigation revealed that the downloaded community map folder contained nothing suspicious, including no executable files, DLLs, batch files, or scripts. Scanning the asset files also yielded no executables. Even a manual malware scan of the folder revealed no obvious red flags, suggesting it had passed Steam Workshop's review process.

Upon further investigation, we found data with unusual names in a file called 'AssetRegistry.bin,' which manages the map data. AssetRegistry.bin is a file that records what objects are placed in the map, and normally it lists the names of objects used in the game, such as lighting and the player's starting point.

However, it contained an object named 'BP_RCE_Test_C_0'. Its class is named 'BP_AmbientController_C' and appears in folders such as 'Environments and Lighting,' suggesting a harmless environment or lighting system. However, the placed object still retained its previous name, 'BP_RCE_Test'. In Unreal Engine, the name of an object already placed on the map is retained even if its name is changed later. Therefore, this was investigated as evidence that the Blueprint was previously named 'BP_RCE_Test'.



Feint then unpacked the Unreal Engine 5 asset container containing the game's data and examined its contents in detail. He discovered a total of 55 data items, including materials, meshes, textures, four maps, and three Blueprints. Of these, he decided to analyze in detail the processing concentrated in one particularly prominent Blueprint. The analysis revealed that this processing was performing an operation that wrote files to Windows. Specifically, when the game was started, it located the user's 'Documents' folder and created a batch file called 's.bat' there.

Furthermore, the Blueprint contained a special string that could be treated as JSON but functioned as a command when executed as a batch file. The researchers described this as a 'JSON/batch polyglot.' Since the Blueprint has a process for writing JSON data to a file, it is believed that this string was intentionally constructed to maintain a format that can be saved as JSON while also including a command that can be executed as a batch file.

Upon investigating the role of the generated batch file, it was discovered that it performed a two-stage process. The first execution resulted in a brief black command prompt screen appearing, as the batch file restarted itself and immediately terminated. The second stage involved downloading and installing a Remote Access Trojan (RAT) on the affected system, allowing the attacker to remotely control the compromised PC. This significantly increases the severity of the attack, as it not only executes a batch file but also enables persistent remote access to the infected machine. Therefore, it appears the batch file itself was not the final payload, but rather a 'dropper' that invoked another malicious program.



Feint stated, 'While there were some aspects we couldn't directly observe during the investigation, from what I've seen, it's unusual for a Steam Workshop map to write a .bat file to a user's documents folder and then retrieve another file from the internet. I believe there's a very high probability that this workshop item is malicious.' He also noted that while 'Laser Tag Neon,' which Feint investigated, has been removed from the Steam Workshop, other maps that appear to contain malicious intent haven't been removed. Therefore, he warned, 'Only download popular maps with an established player base. If the uploader has a brand new Steam account or has disabled the comment function for the workshop item, consider it a serious red flag.'

A few days after Feint's report, Haganeiro and Remorion, the developers of 'Mecha Chameleon,' released 'Version 3.1.0' which fixed the game's vulnerability. However, during the process of removing the hack, the developers' PCs became infected with malware, and the hackers used this to take over the 'Mecha Chameleon' Discord server, which has 100,000 members. Remorion posted on X urging members to leave the Discord server and explained, 'While fixing a problem where malware was embedded in a MOD map, a system engineer's PC became infected with malware. Subsequently, the hackers bypassed the engineer's Discord two-factor authentication, changed server permissions, and banned all administrators.' They also stated that the game itself is 100% virus-free, the infected PC was a backup, and there is no risk of game data being edited.




Approximately 30 hours after Mr. Remorion's initial report, it was announced that they had contacted Discord and regained access to the channel.




Later that afternoon, a mini-update to the game, version 3.3.1, was released, which included a fix for the Discord URL on the title screen and further enhancements to the antivirus software.




Related Posts:

in Game,   Security, Posted by log1e_dh