Players of indie hit Meccha Chameleon have been warned to update the game and steer clear of its original Discord server after malicious Steam Workshop maps infected PCs.
In a report from Dexterto, the issue was first uncovered by independent researcher Feint, who looked into player reports of strange black windows briefly flashing on screen while loading custom maps. Feint traced the problem to a downloadable map called “Laser Tag Neon,” which secretly installed a hidden file on players’ computers the moment it loaded.
That file is believe to have then quietly reached out to the internet to download a second, more dangerous piece of malware behind the scenes. The map was removed, though another infected one, “Chroma Grid Arena,” reportedly popped up in its place. Feint later found that the follow-up malware gave attackers ongoing remote access to infected computers. Feint noted that simply downloading a malicious map wasn’t enough to get infected; players had to actually load and play the map.
Mashable Light Speed
Meccha Chameleon co-developer Haganeiro said the underlying flaw was fixed in update 3.1.0, and disabled the malicious code on affected maps even for players who hadn’t updated yet.
Despite the update, according to Dexerto, a systems engineer investigating the malware for the developers had their backup computer infected, and the hackers used the compromised machine to access the engineer’s Discord account. Per Developer LEMORION, the hackers altered server permissions and banned staff members from the game’s roughly 100,000-member official server.
It was also reported that the compromised device had no access to Meccha Chameleon‘s source code, game files, or Steam developer accounts, and that claims that the hijacked server had infected the official game build itself were disputed.
A replacement community server has since been stood up while the studio awaits a response from Discord’s support team.
