Technology news and discussion on TalkFuse.
Meccha Chameleon Players Are Getting Malware From User-Made Maps
Malicious user-made Steam Workshop maps for Meccha Chameleon were found to exploit a vulnerability that could install malware on players’ computers when a map was launched. The incident matters because it shows how seemingly legitimate community content can be used to compromise users, although the developer says the game itself was not infected and the vulnerability has been fixed.
One identified map, Laser Tag Neon, was removed, while reports indicated that another malicious map appeared afterwards. During the investigation, a system engineer’s computer was reportedly infected and the attacker used this to take over the game’s official Discord server, bypassing two-factor authentication and removing staff access; players were warned not to trust links or announcements from that server.
In short
- Malicious Workshop maps exploited a now-patched game vulnerability.
- The base game was not reported to contain malware.
- The official Discord server was also compromised.
Explained simply
Meccha Chameleon is a computer game available on Steam, a popular platform for buying and playing games on PC. Players can create and share custom maps with others through a community feature, allowing fans to contribute their own content.
Several of these fan-made maps contained malware that could infect players' computers when the maps were loaded. A security flaw in how the game handled these maps allowed attackers to exploit it and install harmful software. One map called Laser Tag Neon was identified and removed, though additional malicious maps reportedly appeared afterwards.
The compromise extended further when an attacker used an infected system engineer's computer to take over the game's official Discord server, a chat platform where players gather. By bypassing security measures, the attacker locked legitimate staff out of the server. The developer has since fixed the vulnerability and stated the game itself was not compromised.
Cybersecurity Entertainment Gaming Technology