Meccha Chameleon Steam Workshop Malware: Maps, Discord Takeover, What to Do

Meccha Chameleon spent June and July as Steam's friendslop poster child — paint-to-hide chaos, clone farms on Roblox, and a reported 15 million sales sprint. On July 24–26, 2026, that success became a security story: malicious Steam Workshop maps delivered malware when players loaded them, and while the team patched the hole, an infected engineer PC let attackers bypass Discord 2FA, seize the official server (~100,000 members), and ban staff.

Dexerto summarized the chain for a huge audience on July 26. bunpav's take: this is not "Steam is broken forever." It is what happens when a viral Workshop game ships map scripting that can touch the OS — then investigators have to open the same poison to dissect it.

TL;DR — what people are actually asking

What Feint found in the Workshop

Independent researcher Feint (also referenced as FeintBe in some write-ups) published a Medium breakdown after players reported command-prompt flashes when loading custom maps. Per Dexerto, Kotaku, and PC Gamer's reporting:

1. A Workshop map (Laser Tag Neon) that had passed Workshop review could write a batch file into the player's Documents folder when the map was launched in a match.
2. That batch used PowerShell to download and run a second payload from an external server.
3. Feint later analyzed that payload as a Remote Access Trojan (RAT) — persistent remote control, not a harmless joke crash.
4. After Laser Tag Neon was removed, new malicious maps (including one Feint flagged as Chroma Grid Arena) appeared — classic Whac-A-Mole.

Critical nuance from Feint: subscribing is not infection. The malware path required loading the map in-game. That still means party lobbies and "try this funny map" Discord invites were high-risk vectors for a game whose entire culture is Workshop comedy stages.

The patch — and why "disabled on old maps" matters

Developer Haganeiro stated on X that update 3.1.0 fixed the custom-map vulnerability:

The vulnerability in the custom maps described in today's update 3.1.0 has been fixed, so there are no issues after applying it. We have also confirmed that the malware is disabled for the affected maps both before and after the update.

That second sentence is the player-safety line: even if someone has not updated yet, identified maps were reportedly neutralized on the content side. Still update. Do not rely on remote kill-switches as your only defense.

Later coverage (TheGamer and others) describes 3.2.0 as further confirmation — with Steam Support involvement — that executing unrelated files such as malware from maps is now impossible. Check your Steam client's installed build number before you argue in voice chat.

How Discord got taken over (the ugly middle chapter)

While investigating and patching, a system engineer used a backup / spare testing PC that became infected with the same class of malware. Developer lemorion_1224 (LEMORION) explained the cascade:

• Hacker accessed the engineer's Discord account
• Bypassed two-factor authentication
• Altered server permissions
• Banned all official staff

Steam News put the community warning in bold: the game itself is not affected; the official Discord was hacked; Discord Support was contacted; if recovery fails, a new server would be stood up. Players were told not to follow suspicious links.

Attackers on the hijacked server reportedly pushed messages claiming the Steam build was infected. The team denied that and stressed the spare PC had no access to source, game files, or Steamworks admin — then wiped and reformatted the machine.

Caveat: "Bypassed 2FA" in incident write-ups often means session/token theft from an already-logged-in infected machine, not cracking TOTP math. Functionally, for players, the result is the same: the old Discord is not a trusted channel.

Why friendslop + Workshop is a special risk class

Meccha Chameleon sits at the top of our friendslop ranking conversation for a reason: cheap group buys, streamer clips, constant new maps. That culture is also an attacker's dream:

• New Steam accounts can upload maps faster than humans review them
• "Just try this map" social pressure overrides caution
• Party games normalize weird one-frame console flashes as "jank"
• Official Discords become the single source of truth for lobby codes — until they are not

This is adjacent to other trust failures we cover — PCSX5 emulator scams, fake PS5 emulation pages — different delivery, same lesson: viral download surfaces need assume-hostile defaults.

Steam Workshop is not uniquely evil. Unsigned map scripting that can shell out to the OS is. Games that need rich user content must sandbox harder than a weekend indie expects when they suddenly have eight-figure sales.

What you should do today (players)

1. Update Meccha Chameleon via Steam — confirm you are on 3.1.0+ (prefer whatever latest build Steam shows after 3.2.0 coverage).
2. If you launched unknown Workshop maps before the patch, run a full AV / anti-malware scan now.
3. Check Documents and temp for recently created .bat files; quarantine anything you did not create.
4. Rotate passwords for Discord, Steam, email, and anything stored in a browser on that PC — assume credential theft if you were infected.
5. Leave / mute the old official Discord until the team announces a verified recovery or points you to the replacement invite from Steam News or verified X accounts (@lemorion1224, @haganeiro_fn).
6. Ignore "Steam build has virus" posts on the compromised server — that was attacker narrative.
7. Workshop hygiene going forward: prefer maps with history, real comment sections, and non-brand-new uploaders; Feint's advice tracks.

What studios should steal from this incident

1. Sandbox user content like it is hostile. If a map format can write arbitrary files, it will.
2. Don't investigate malware on a machine that holds Discord admin sessions. Air-gap the forensics box.
3. Pre-stage a break-glass community channel (second Discord, Steam News, website) before you need it.
4. Say "game depot is clean" loudly and early — attackers will claim otherwise on your own microphone.
5. Kill-switch malicious Workshop items and say so publicly — Haganeiro's "disabled even pre-update" line matters.

Timeline at a glance

Keep using Steam News and verified X accounts as the source of truth. Compromised community servers are where attackers plant "helpful" download links.

How this changes Workshop etiquette for party games

Before this week, Meccha lobby culture treated Workshop like a meme folder: subscribe, load, laugh, unsubscribe. After this week, treat unknown maps like email attachments from strangers.

Practical lobby rules that do not kill the fun:

1. One trusted host picks maps from a short allowlist
2. No brand-new uploaders during a session
3. Update check before the first custom map of the night
4. If a console window flashes, stop the match and scan — do not shrug it off as Unity jank

That is how friendslop stays social instead of becoming a malware distribution channel with paint guns.

bunpav's bottom line

Meccha Chameleon did not "ship a virus." It shipped a viral Workshop surface that got weaponized, then got patched under fire while Discord fell for the classic investigator-infects-self sequel. Update the game. Distrust the old Discord. Scan if you played mystery maps. Keep painting — just not on someone else's PowerShell.

The sales story and the security story are the same story: scale arrives faster than sandboxing. Fifteen million copies is a trophy. Surviving the Workshop week without losing the Steam depot is the harder flex.

Related reading

• What is Meccha Chameleon? 15M sales and Roblox clones
• Top 10 friendslop games in 2026
• PCSX5 fake PS5 emulator scam warning
• RPCS3 / SharpEmu / KytyPS5 vs emulator scams
• Dear Passengers — viral co-op airplane game
• Palworld 1.0 Steam peak
• Roblox Build AI mobile creation
• Dexerto — malware maps and Discord takeover
• PC Gamer — fixes after malware and Discord hack
• Steam News — Discord hacked, game not affected
• Kotaku — Workshop maps and Discord hack

Timeline, map names, patch versions, and Discord details reflect July 24–26, 2026 developer statements and reporting from Dexerto, PC Gamer, Kotaku, and Steam News. Verify the latest Steam build and official X/Steam announcements before trusting any Discord invite.