Meccha Chameleon, this year's surprise hit game with over 15 million sales in under a month, has been hit by a malware attack via infected user-created Steam Workshop maps. Hackers embedded a Remote Access Trojan in community maps such as Laser Tag Neon, allowing them to remotely control victims' PCs; the incident escalated when a developer's own infected computer was used to hijack the game's 100,000-member Discord server after bypassing two-factor authentication.

Researcher Feint first flagged the malicious maps, prompting their removal, though replacement infected maps such as Chroma Grid Arena later appeared. Developers lemorion_1224 and Haganeiro released a patch (version 3.1.0) to close the vulnerability, but in doing so infected their own system, leading to the Discord takeover and staff bans. The developers have since regained control of the Discord, banned the hackers' admin accounts, wiped the compromised PC, and released a further security update (3.3.1). It remains unclear how many players were affected, though a July 8 Steam review described similar symptoms, and the incident follows other recent Steam malware cases, including Valve's removal of the horror game Beyond The Dark.