A recent vulnerability in Meccha Chameleon, now resolved, raised concerns as it allowed several Steam Workshop maps to inadvertently distribute malware to players. In a detailed post on Medium, user Feint shared alarming reports from friends who noticed a command prompt window appearing briefly during the download of a custom workshop map. Upon investigation, Feint discovered that what seemed to be an ordinary map was, in fact, a malware dropper that had somehow passed the workshop’s review process.
Swift Response and Resolution
In a follow-up post on X, the game’s developer, Haganeiro, reassured the community that the vulnerability identified in the recent update (version 3.1.0) had been promptly addressed. “The vulnerability in the custom maps described in today’s update has been fixed, so there are no issues after applying it,” Haganeiro stated. Furthermore, the developer confirmed that the malware associated with the affected maps has been disabled both before and after the update.
However, the challenges faced by the development team did not end there. The official Discord server for Meccha Chameleon, boasting nearly 100,000 members, was also compromised. This breach was acknowledged in a blog post on the Steam Community, where the developers informed players of the situation. “We have already contacted Discord Support and are currently awaiting their response,” the post explained. “If the server cannot be recovered, we will set up a new one.”
Adding to the complexity of the situation, it was revealed that the breach occurred due to a system engineer’s PC being infected with malware while addressing the previously mentioned vulnerabilities. The hacker managed to bypass the engineer’s two-factor authentication on Discord, altering server permissions and banning all staff members in the process. As a precaution, lemorion_1224, another member of the team, advised players to avoid any “suspicious links” circulating on the compromised Discord server.
